1 files changed, 2 insertions, 2 deletions
diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp
index c952e1b40a..640a185981 100644
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -943,8 +943,8 @@ bool NativeObject::growElements(JSContext* cx, uint32_t reqCapacity) {
     // For arrays with writable length, and all non-Array objects, call
     // `NativeObject::goodElementsAllocationAmount()` to determine the
     // amount to allocate from the the requested capacity and existing length.
-    if (!goodElementsAllocationAmount(cx, reqCapacity + numShifted,
-                                      getElementsHeader()->length,
+    uint32_t length = is<ArrayObject>() ? as<ArrayObject>().length() : 0;
+    if (!goodElementsAllocationAmount(cx, reqCapacity + numShifted, length,
                                       &newAllocated)) {
       return false;
     }