new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/reverse-frozen.js
@@ -0,0 +1,6 @@
+// |jit-test| error: TypeError
+
+x = [0];
+x.length = 9;
+Object.freeze(x);
+x.reverse();

--- a/js/src/vm/NativeObject-inl.h
+++ b/js/src/vm/NativeObject-inl.h
@@ -156,17 +156,17 @@ NativeObject::extendDenseElements(Exclus
     MOZ_ASSERT(!denseElementsAreCopyOnWrite());
 
     /*
      * Don't grow elements for non-extensible objects or watched objects. Dense
      * elements can be added/written with no extensible or watchpoint checks as
      * long as there is capacity for them.
      */
     if (!nonProxyIsExtensible() || watched()) {
-        MOZ_ASSERT(getDenseCapacity() == 0);
+        MOZ_ASSERT(getDenseCapacity() == 0 || (!watched() && getElementsHeader()->isFrozen()));
         return DenseElementResult::Incomplete;
     }
 
     /*
      * Don't grow elements for objects which already have sparse indexes.
      * This avoids needing to count non-hole elements in willBeSparseElements
      * every time a new index is added.
      */