diff --git a/js/src/jit/shared/Assembler-shared.h b/js/src/jit/shared/Assembler-shared.h
index 6d623293cd..f18cbb9e1d 100644
--- a/js/src/jit/shared/Assembler-shared.h
+++ b/js/src/jit/shared/Assembler-shared.h
@@ -725,7 +725,6 @@ class MemoryAccessDesc
         trapOffset_(trapOffset)
     {
         MOZ_ASSERT(Scalar::isSimdType(type) == (numSimdElems > 0));
-        MOZ_ASSERT(numSimdElems <= jit::ScalarTypeToLength(type));
         MOZ_ASSERT(mozilla::IsPowerOfTwo(align));
         MOZ_ASSERT_IF(isSimd(), hasTrap());
         MOZ_ASSERT_IF(isAtomic(), hasTrap());
diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp
index d21f88b15e..cde86fb829 100644
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -2392,6 +2392,15 @@ SetExistingProperty(JSContext* cx, HandleNativeObject obj, HandleId id, HandleVa
             Rooted<TypedArrayObject*> tobj(cx, &pobj->as<TypedArrayObject>());
             return SetTypedArrayElement(cx, tobj, index, v, result);
           }
+
+          if (WouldDefinePastNonwritableLength(pobj, index))
+            return result.fail(JSMSG_CANT_DEFINE_PAST_ARRAY_LENGTH);
+
+          if (!pobj->maybeCopyElementsForWrite(cx))
+            return false;
+ 
+          pobj->setDenseElementWithType(cx, index, v);
+          return result.succeed();
         }
 
         // Steps 5.b-f.