diff --git a/js/xpconnect/src/Sandbox.cpp b/js/xpconnect/src/Sandbox.cpp
index 611499f9c0d4..c3c23a384ead 100644
--- a/js/xpconnect/src/Sandbox.cpp
+++ b/js/xpconnect/src/Sandbox.cpp
@@ -327,10 +327,13 @@ sandbox_finalize(js::FreeOp *fop, JSObject *obj)
 static void
 sandbox_moved(JSObject *obj, const JSObject *old)
 {
+    // Note that this hook can be called before the private pointer is set. In
+    // this case the SandboxPrivate will not exist yet, so there is nothing to
+    // do.
     nsIScriptObjectPrincipal *sop =
         static_cast<nsIScriptObjectPrincipal *>(xpc_GetJSPrivate(obj));
-    MOZ_ASSERT(sop);
-    static_cast<SandboxPrivate *>(sop)->ObjectMoved(obj, old);
+    if (sop)
+        static_cast<SandboxPrivate *>(sop)->ObjectMoved(obj, old);
 }
 
 static bool