new file mode 100644
--- /dev/null
+++ b/js/xpconnect/tests/unit/test_bug1033920.js
@@ -0,0 +1,7 @@
+const Cu = Components.utils;
+function run_test() {
+  var sb = Cu.Sandbox('http://www.example.com');
+  var o = new sb.Object();
+  o.__proto__ = null;
+  do_check_eq(Object.getPrototypeOf(o), null);
+}

--- a/js/xpconnect/tests/unit/xpcshell.ini
+++ b/js/xpconnect/tests/unit/xpcshell.ini
@@ -38,16 +38,17 @@ support-files =
 [test_bug868675.js]
 [test_bug867486.js]
 [test_bug872772.js]
 [test_bug885800.js]
 [test_bug961054.js]
 [test_bug976151.js]
 [test_bug1001094.js]
 [test_bug1021312.js]
+[test_bug1033920.js]
 [test_bug_442086.js]
 [test_file.js]
 [test_blob.js]
 [test_blob2.js]
 [test_file2.js]
 [test_import.js]
 [test_import_fail.js]
 [test_js_weak_references.js]

--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -2217,17 +2217,17 @@ XrayWrapper<Base, Traits>::setPrototypeO
         return Base::setPrototypeOf(cx, wrapper, proto, bp);
 
     RootedObject target(cx, Traits::getTargetObject(wrapper));
     RootedObject expando(cx, Traits::singleton.ensureExpandoObject(cx, wrapper, target));
 
     // The expando lives in the target's compartment, so do our installation there.
     JSAutoCompartment ac(cx, target);
 
-    RootedValue v(cx, ObjectValue(*proto));
+    RootedValue v(cx, ObjectOrNullValue(proto));
     if (!JS_WrapValue(cx, &v))
         return false;
     JS_SetReservedSlot(expando, JSSLOT_EXPANDO_PROTOTYPE, v);
     *bp = true;
     return true;
 }