--- a/js/src/vm/ObjectImpl-inl.h
+++ b/js/src/vm/ObjectImpl-inl.h
@@ -323,17 +323,20 @@ NativeObject::copy(ExclusiveContext *cx,
     if (!baseObj)
         return nullptr;
     NativeObject *obj = &baseObj->as<NativeObject>();
 
     size_t span = shape->slotSpan();
     if (span) {
         uint32_t numFixed = templateObject->numFixedSlots();
         const Value *fixed = &templateObject->getSlot(0);
-        MOZ_ASSERT(numFixed <= span);
+        // Only copy elements which are registered in the shape, even if the
+        // number of fixed slots is larger.
+        if (span < numFixed)
+            numFixed = span;
         obj->copySlotRange(0, fixed, numFixed);
 
         if (numFixed < span) {
             uint32_t numSlots = span - numFixed;
             const Value *slots = &templateObject->getSlot(numFixed);
             obj->copySlotRange(numFixed, slots, numSlots);
         }
     }