1 files changed, 9 insertions, 8 deletions
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index e618c319f..73243d918 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2105,14 +2105,15 @@ js::ArrayShiftMoveElements(NativeObject* obj)
     MOZ_ASSERT_IF(obj->is<ArrayObject>(), obj->as<ArrayObject>().lengthIsWritable());
 
     size_t initlen = obj->getDenseInitializedLength();
-    MOZ_ASSERT(initlen > 0);
-
-    /*
-     * At this point the length and initialized length have already been
-     * decremented and the result fetched, so just shift the array elements
-     * themselves.
-     */
-    obj->moveDenseElementsNoPreBarrier(0, 1, initlen);
+    
+    if (initlen > 0) {
+      /*
+       * At this point the length and initialized length have already been
+       * decremented and the result fetched, so just shift the array elements
+       * themselves.
+       */
+      obj->moveDenseElementsNoPreBarrier(0, 1, initlen);
+    }
 }
 
 static inline void