--- a/js/src/jit/AsmJSModule.cpp
+++ b/js/src/jit/AsmJSModule.cpp
@@ -332,16 +332,18 @@ AsmJSModule::finish(ExclusiveContext *cx
     for (size_t i = 0; i < callSites_.length(); i++) {
         CallSite &c = callSites_[i];
         c.setReturnAddressOffset(masm.actualOffset(c.returnAddressOffset()));
     }
     for (size_t i = 0; i < codeRanges_.length(); i++) {
         CodeRange &c = codeRanges_[i];
         c.begin_ = masm.actualOffset(c.begin_);
         c.end_ = masm.actualOffset(c.end_);
+        JS_ASSERT(c.begin_ <= c.end_);
+        JS_ASSERT_IF(i > 0, codeRanges_[i - 1].end_ <= c.begin_);
     }
 #endif
     JS_ASSERT(pod.functionBytes_ % AsmJSPageSize == 0);
 
     // Absolute link metadata: absolute addresses that refer to some fixed
     // address in the address space.
     for (size_t i = 0; i < masm.numAsmJSAbsoluteLinks(); i++) {
         AsmJSAbsoluteLink src = masm.asmJSAbsoluteLink(i);

--- a/js/src/jit/AsmJSModule.h
+++ b/js/src/jit/AsmJSModule.h
@@ -692,18 +692,16 @@ class AsmJSModule
     void requireHeapLengthToBeAtLeast(uint32_t len) {
         JS_ASSERT(isFinishedWithModulePrologue() && !isFinishedWithFunctionBodies());
         if (len > pod.minHeapLength_)
             pod.minHeapLength_ = len;
     }
     bool addFunctionCodeRange(PropertyName *name, uint32_t begin, uint32_t end) {
         JS_ASSERT(isFinishedWithModulePrologue() && !isFinishedWithFunctionBodies());
         JS_ASSERT(name->isTenured());
-        JS_ASSERT(begin <= end);
-        JS_ASSERT_IF(!codeRanges_.empty(), codeRanges_.back().end() <= begin);
         if (functionNames_.length() >= UINT32_MAX)
             return false;
         CodeRange codeRange(CodeRange::Function, begin, end, functionNames_.length());
         return functionNames_.append(name) && codeRanges_.append(codeRange);
     }
     bool addEntryCodeRange(unsigned exportIndex, uint32_t end) {
         uint32_t begin = exports_[exportIndex].pod.codeOffset_;
         CodeRange codeRange(CodeRange::Entry, begin, end, UINT32_MAX);