diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp
index 66fab363c7b..909657bffef 100644
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -1453,36 +1453,12 @@ static MOZ_ALWAYS_INLINE bool AddOrChangeProperty(
 
   MOZ_ASSERT(slot < obj->slotSpan());
 
-  // Clear any existing dense index after adding a sparse indexed property,
-  // and investigate converting the object to dense indexes.
+  // Clear any existing dense index after adding a sparse indexed property.
   if (id.isInt()) {
-    uint32_t index = id.toInt();
     if constexpr (AddOrChange == IsAddOrChange::Add) {
-      MOZ_ASSERT(!obj->containsDenseElement(index));
+      MOZ_ASSERT(!obj->containsDenseElement(id.toInt()));
     } else {
-      obj->removeDenseElementForSparseIndex(index);
-    }
-    // Only try to densify sparse elements if the property we just added/changed
-    // is in the last slot. This avoids a perf cliff in pathological cases: in
-    // maybeDensifySparseElements we densify if the slot span is a power-of-two,
-    // but if we get slots from the free list, the slot span will stay the same
-    // until the free list is empty. This means we'd get quadratic behavior by
-    // trying to densify for each sparse element we add. See bug 1782487.
-    if (slot == obj->slotSpan() - 1) {
-      DenseElementResult edResult =
-          NativeObject::maybeDensifySparseElements(cx, obj);
-      if (edResult == DenseElementResult::Failure) {
-        return false;
-      }
-      if (edResult == DenseElementResult::Success) {
-        MOZ_ASSERT(!desc.isAccessorDescriptor());
-        if constexpr (AddOrChange == IsAddOrChange::Add) {
-          if (!CallAddPropertyHookDense(cx, obj, index, desc.value())) {
-            return false;
-          }
-        }
-        return true;
-      }
+      obj->removeDenseElementForSparseIndex(id.toInt());
     }
   }
 
@@ -1498,6 +1474,25 @@ static MOZ_ALWAYS_INLINE bool AddOrChangeProperty(
     }
   }
 
+  // Investigate converting the object to dense indexes. This is fallible so we
+  // do this after the add-property hook.
+  //
+  // Only try to densify sparse elements if the property we just added/changed
+  // is in the last slot. This avoids a perf cliff in pathological cases: in
+  // maybeDensifySparseElements we densify if the slot span is a power-of-two,
+  // but if we get slots from the free list, the slot span will stay the same
+  // until the free list is empty. This means we'd get quadratic behavior by
+  // trying to densify for each sparse element we add. See bug 1782487.
+  if (id.isInt() && slot == obj->slotSpan() - 1) {
+    DenseElementResult edResult =
+        NativeObject::maybeDensifySparseElements(cx, obj);
+    if (edResult == DenseElementResult::Failure) {
+      return false;
+    }
+    MOZ_ASSERT_IF(edResult == DenseElementResult::Success,
+                  !desc.isAccessorDescriptor());
+  }
+
   return true;
 }
 
diff --git a/js/src/jit-test/tests/arrays/densify-sparse-oom.js b/js/src/jit-test/tests/arrays/densify-sparse-oom.js
new file mode 100644
index 00000000000..8571d39d5c8
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/densify-sparse-oom.js
@@ -0,0 +1,60 @@
+// |jit-test| skip-if: !hasFunction.oomAtAllocation
+
+gczeal(0);
+
+// Arrange for adding index 10 to use the last property slot and make the slot
+// span a power of two, so the sparse elements can be densified.
+function makeSparse() {
+  let a = [];
+  Object.defineProperty(a, 0, {
+    value: 0, writable: true, configurable: true, enumerable: false
+  });
+  a.x = 0;
+  a.y = 0;
+  delete a.x;
+  a.x = 0;
+  for (let i = 6; i < 10; i++) {
+    a[i] = i;
+  }
+  a.z = 0;
+  delete a.x;
+  a.w = 0;
+  delete a.z;
+  Object.defineProperty(a, 0, {enumerable: true});
+  return a;
+}
+
+const desc = {
+  value: {}, writable: true, configurable: true, enumerable: true
+};
+function add(a) {
+  Object.defineProperty(a, 10, desc);
+}
+
+add(makeSparse());
+for (let n = 1; ; n++) {
+  let a = makeSparse();
+  oomAtAllocation(n);
+  try {
+    add(a);
+  } catch (e) {
+  }
+  let hadOOM = resetOOMFailure();
+
+  assertEq(a.length, Object.hasOwn(a, 10) ? 11 : 10);
+
+  Object.defineProperty(a, 10, {
+    value: {}, writable: true, configurable: true, enumerable: true
+  });
+  assertEq(a.length, 11);
+
+  verifyprebarriers();
+  a.length = a.length;
+  a.length = 10;
+  verifyprebarriers();
+  assertEq(Object.hasOwn(a, 10), false);
+
+  if (!hadOOM) {
+    break;
+  }
+}

diff --git a/js/src/jit-test/tests/arrays/densify-sparse-oom.js b/js/src/jit-test/tests/arrays/densify-sparse-oom.js
new file mode 100644
index 00000000000..8571d39d5c8
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/densify-sparse-oom.js
@@ -0,0 +1,60 @@
+// |jit-test| skip-if: !hasFunction.oomAtAllocation
+
+gczeal(0);
+
+// Arrange for adding index 10 to use the last property slot and make the slot
+// span a power of two, so the sparse elements can be densified.
+function makeSparse() {
+  let a = [];
+  Object.defineProperty(a, 0, {
+    value: 0, writable: true, configurable: true, enumerable: false
+  });
+  a.x = 0;
+  a.y = 0;
+  delete a.x;
+  a.x = 0;
+  for (let i = 6; i < 10; i++) {
+    a[i] = i;
+  }
+  a.z = 0;
+  delete a.x;
+  a.w = 0;
+  delete a.z;
+  Object.defineProperty(a, 0, {enumerable: true});
+  return a;
+}
+
+const desc = {
+  value: {}, writable: true, configurable: true, enumerable: true
+};
+function add(a) {
+  Object.defineProperty(a, 10, desc);
+}
+
+add(makeSparse());
+for (let n = 1; ; n++) {
+  let a = makeSparse();
+  oomAtAllocation(n);
+  try {
+    add(a);
+  } catch (e) {
+  }
+  let hadOOM = resetOOMFailure();
+
+  assertEq(a.length, Object.hasOwn(a, 10) ? 11 : 10);
+
+  Object.defineProperty(a, 10, {
+    value: {}, writable: true, configurable: true, enumerable: true
+  });
+  assertEq(a.length, 11);
+
+  verifyprebarriers();
+  a.length = a.length;
+  a.length = 10;
+  verifyprebarriers();
+  assertEq(Object.hasOwn(a, 10), false);
+
+  if (!hadOOM) {
+    break;
+  }
+}