--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2602,17 +2602,17 @@ js::array_splice_impl(JSContext* cx, uns
          * simplicity, have the slow-path code do it.  (Also note that the slow
          * path may validly *not* throw -- if all the elements being moved are
          * holes.)
          */
         if (obj->is<ArrayObject>()) {
             Rooted<ArrayObject*> arr(cx, &obj->as<ArrayObject>());
             if (arr->lengthIsWritable()) {
                 DenseElementResult result =
-                    arr->ensureDenseElements(cx, arr->length(), itemCount - actualDeleteCount);
+                    arr->ensureDenseElements(cx, len, itemCount - actualDeleteCount);
                 if (result == DenseElementResult::Failure)
                     return false;
             }
         }
 
         if (CanOptimizeForDenseStorage(obj, len, itemCount - actualDeleteCount, cx)) {
             DenseElementResult result =
                 MoveAnyBoxedOrUnboxedDenseElements(cx, obj, actualStart + itemCount,