diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index ecc0a0696508..d75a977521a3 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1860,7 +1860,11 @@ JSObject::fixupAfterMovingGC()
     if (is<NativeObject>()) {
         NativeObject& obj = as<NativeObject>();
         if (obj.denseElementsAreCopyOnWrite()) {
-            NativeObject* owner = MaybeForwarded(obj.getElementsHeader()->ownerObject().get());
+            NativeObject* owner = obj.getElementsHeader()->ownerObject();
+            // Get the new owner pointer but don't call MaybeForwarded as we
+            // don't need to access the object's shape.
+            if (IsForwarded(owner))
+                owner = Forwarded(owner);
             if (owner != &obj && owner->hasFixedElements())
                 obj.elements_ = owner->getElementsHeader()->elements();
             MOZ_ASSERT(!IsForwarded(obj.getElementsHeader()->ownerObject().get()));