--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -425,17 +425,19 @@ SetArrayElement(JSContext* cx, HandleObj
  * non-configurable, but proxies may implement different semantics.)
  */
 static bool
 DeleteArrayElement(JSContext* cx, HandleObject obj, double index, ObjectOpResult& result)
 {
     MOZ_ASSERT(index >= 0);
     MOZ_ASSERT(floor(index) == index);
 
-    if (obj->is<ArrayObject>() && !obj->isIndexed()) {
+    if (obj->is<ArrayObject>() && !obj->isIndexed() &&
+        !obj->as<NativeObject>().denseElementsAreFrozen())
+    {
         ArrayObject* aobj = &obj->as<ArrayObject>();
         if (index <= UINT32_MAX) {
             uint32_t idx = uint32_t(index);
             if (idx < aobj->getDenseInitializedLength()) {
                 if (!aobj->maybeCopyElementsForWrite(cx))
                     return false;
                 if (idx+1 == aobj->getDenseInitializedLength()) {
                     aobj->setDenseInitializedLength(idx);