--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -97,16 +97,20 @@ CloseNativeIterator(JSContext *cx, JSObj
 
     JS_ASSERT(iterobj->getClass() == &js_IteratorClass);
 
     /* Avoid double work if CloseNativeIterator was called on obj. */
     state = iterobj->getSlot(JSSLOT_ITER_STATE);
     if (JSVAL_IS_NULL(state))
         return;
 
+    /* Avoid misinterpreting default-void slots in a stillborn iterator. */
+    if (JSVAL_IS_VOID(state))
+        return;
+
     /* Protect against failure to fully initialize obj. */
     iterable = iterobj->getParent();
     if (iterable) {
 #if JS_HAS_XML_SUPPORT
         uintN flags = JSVAL_TO_INT(iterobj->getSlot(JSSLOT_ITER_FLAGS));
         if ((flags & JSITER_FOREACH) && OBJECT_IS_XML(cx, iterable)) {
             js_EnumerateXMLValues(cx, iterable, JSENUMERATE_DESTROY, &state,
                                   NULL, NULL);