diff --git a/js/src/builtin/Array.cpp b/js/src/builtin/Array.cpp
index 9d6722fe939..2c68b8d3066 100644
--- a/js/src/builtin/Array.cpp
+++ b/js/src/builtin/Array.cpp
@@ -907,6 +907,12 @@ bool js::ArraySetLength(JSContext* cx, Handle<ArrayObject*> arr, HandleId id,
     }
   } while (false);
 
+  // Trim the initialized length, if needed, to preserve the <= length
+  // invariant. This must happen before the fallible attribute change below.
+  // (Capacity was already reduced during element deletion, if necessary.)
+  arr->setDenseInitializedLengthMaybeNonExtensible(
+      cx, std::min(arr->getDenseInitializedLength(), newLen));
+
   // Update array length. Technically we should have been doing this
   // throughout the loop, in step 19.d.iii.
   arr->setLength(cx, newLen);
@@ -926,16 +932,6 @@ bool js::ArraySetLength(JSContext* cx, Handle<ArrayObject*> arr, HandleId id,
   // All operations past here until the |!succeeded| code must be infallible,
   // so that all element fields remain properly synchronized.
 
-  // Trim the initialized length, if needed, to preserve the <= length
-  // invariant.  (Capacity was already reduced during element deletion, if
-  // necessary.)
-  ObjectElements* header = arr->getElementsHeader();
-  header->initializedLength = std::min(header->initializedLength.get(), newLen);
-
-  if (!arr->isExtensible()) {
-    arr->shrinkCapacityToInitializedLength(cx);
-  }
-
   if (desc.hasWritable() && !desc.writable()) {
     arr->setNonWritableLength(cx);
   }
diff --git a/js/src/vm/ArrayObject.h b/js/src/vm/ArrayObject.h
index ce8c3971681..5f5ba9ef0de 100644
--- a/js/src/vm/ArrayObject.h
+++ b/js/src/vm/ArrayObject.h
@@ -55,6 +55,7 @@ class ArrayObject : public NativeObject {
           .hasSeenArrayExceedsInt32LengthFuse.popFuse(cx);
     }
     getElementsHeader()->length = length;
+    MOZ_ASSERT(getDenseInitializedLength() <= length);
   }
 
   void assertInt32LengthFuse(JSContext* cx) {
diff --git a/js/src/jit-test/tests/arrays/set-length-oom.js b/js/src/jit-test/tests/arrays/set-length-oom.js
new file mode 100644
index 00000000000..4b856da6915
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/set-length-oom.js
@@ -0,0 +1,63 @@
+// |jit-test| skip-if: !hasFunction.oomAtAllocation
+
+gczeal(0);
+
+function put(a, i, v) {
+  a[i] = v;
+}
+function make() {
+  let a = new Array(32).fill(1);
+  // Make the custom length property non-last in the shape.
+  a.extra = 0;
+  return a;
+}
+const desc = {value: 16, writable: false};
+function truncate(a) {
+  // Keep an iterator active to use the generic element-deletion path.
+  for (let key in a) {
+    Object.defineProperty(a, "length", desc);
+    break;
+  }
+}
+
+// Attach an in-bounds dense-hole store IC for arrays with this shape.
+let donor = make();
+for (let i = 0; i < 100; i++) {
+  delete donor[0];
+  put(donor, 0, 1);
+}
+truncate(make());
+
+let arrays = [];
+for (let n = 1; ; n++) {
+  let a = make();
+  oomAtAllocation(n);
+  try {
+    truncate(a);
+  } catch (e) {
+  }
+  let hadOOM = resetOOMFailure();
+
+  if (Object.getOwnPropertyDescriptor(a, "length").writable) {
+    put(a, 31, {});
+    assertEq(a.length, 32);
+    arrays.push(a);
+  } else {
+    assertEq(a.length, 16);
+    assertEq(31 in a, false);
+  }
+
+  if (!hadOOM) {
+    break;
+  }
+}
+
+verifyprebarriers();
+for (let a of arrays) {
+  a.length = a.length;
+  a.length = 16;
+}
+verifyprebarriers();
+for (let a of arrays) {
+  assertEq(31 in a, false);
+}

diff --git a/js/src/jit-test/tests/arrays/set-length-oom.js b/js/src/jit-test/tests/arrays/set-length-oom.js
new file mode 100644
index 00000000000..4b856da6915
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/set-length-oom.js
@@ -0,0 +1,63 @@
+// |jit-test| skip-if: !hasFunction.oomAtAllocation
+
+gczeal(0);
+
+function put(a, i, v) {
+  a[i] = v;
+}
+function make() {
+  let a = new Array(32).fill(1);
+  // Make the custom length property non-last in the shape.
+  a.extra = 0;
+  return a;
+}
+const desc = {value: 16, writable: false};
+function truncate(a) {
+  // Keep an iterator active to use the generic element-deletion path.
+  for (let key in a) {
+    Object.defineProperty(a, "length", desc);
+    break;
+  }
+}
+
+// Attach an in-bounds dense-hole store IC for arrays with this shape.
+let donor = make();
+for (let i = 0; i < 100; i++) {
+  delete donor[0];
+  put(donor, 0, 1);
+}
+truncate(make());
+
+let arrays = [];
+for (let n = 1; ; n++) {
+  let a = make();
+  oomAtAllocation(n);
+  try {
+    truncate(a);
+  } catch (e) {
+  }
+  let hadOOM = resetOOMFailure();
+
+  if (Object.getOwnPropertyDescriptor(a, "length").writable) {
+    put(a, 31, {});
+    assertEq(a.length, 32);
+    arrays.push(a);
+  } else {
+    assertEq(a.length, 16);
+    assertEq(31 in a, false);
+  }
+
+  if (!hadOOM) {
+    break;
+  }
+}
+
+verifyprebarriers();
+for (let a of arrays) {
+  a.length = a.length;
+  a.length = 16;
+}
+verifyprebarriers();
+for (let a of arrays) {
+  assertEq(31 in a, false);
+}