diff --git a/js/src/ion/IonCaches.cpp b/js/src/ion/IonCaches.cpp
index 7ef3c83f11c6..54565afa9bff 100644
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -114,7 +114,8 @@ GeneratePrototypeGuards(JSContext *cx, MacroAssembler &masm, JSObject *obj, JSOb
     JSObject *pobj = IsCacheableListBase(obj)
                      ? obj->getTaggedProto().toObjectOrNull()
                      : obj->getProto();
-    JS_ASSERT(pobj);
+    if (!pobj)
+        return;
     while (pobj != holder) {
         if (pobj->hasUncacheableProto()) {
             JS_ASSERT(!pobj->hasSingletonType());
diff --git a/js/src/jit-test/tests/ion/bug807035.js b/js/src/jit-test/tests/ion/bug807035.js
new file mode 100644
index 000000000000..f8ec4b8f63a2
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug807035.js
@@ -0,0 +1,6 @@
+
+x = [0, 0, 0, 0, 0, 0, 0, 0]
+y = ({}).__proto__
+x.sort(function() {
+    y.z
+})