diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp index e618c319fd..73243d9181 100644 --- a/js/src/jsarray.cpp +++ b/js/src/jsarray.cpp @@ -2105,14 +2105,15 @@ js::ArrayShiftMoveElements(NativeObject* obj) MOZ_ASSERT_IF(obj->is(), obj->as().lengthIsWritable()); size_t initlen = obj->getDenseInitializedLength(); - MOZ_ASSERT(initlen > 0); - - /* - * At this point the length and initialized length have already been - * decremented and the result fetched, so just shift the array elements - * themselves. - */ - obj->moveDenseElementsNoPreBarrier(0, 1, initlen); + + if (initlen > 0) { + /* + * At this point the length and initialized length have already been + * decremented and the result fetched, so just shift the array elements + * themselves. + */ + obj->moveDenseElementsNoPreBarrier(0, 1, initlen); + } } static inline void