--- a/js/src/builtin/Array.js
+++ b/js/src/builtin/Array.js
@@ -710,71 +710,53 @@ function CreateArrayIteratorAt(obj, kind
     UnsafeSetReservedSlot(iterator, ITERATOR_SLOT_NEXT_INDEX, n);
     UnsafeSetReservedSlot(iterator, ITERATOR_SLOT_ITEM_KIND, kind);
     return iterator;
 }
 function CreateArrayIterator(obj, kind) {
     return CreateArrayIteratorAt(obj, kind, 0);
 }
 
-// ES6, 22.1.5.2.1
-// https://tc39.github.io/ecma262/#sec-%arrayiteratorprototype%.next
+
 function ArrayIteratorNext() {
-    // Step 1-3.
     if (!IsObject(this) || !IsArrayIterator(this)) {
         return callFunction(CallArrayIteratorMethodIfWrapped, this,
                             "ArrayIteratorNext");
     }
-
-    // Step 4.
-    var a = UnsafeGetReservedSlot(this, ITERATOR_SLOT_TARGET);
-    var result = { value: undefined, done: false };
-
-    // Step 5.
-    if (!a) {
-      result.done = true;
-      return result;
-    }
-
-    // Step 6.
+    var a = UnsafeGetObjectFromReservedSlot(this, ITERATOR_SLOT_TARGET);
     // The index might not be an integer, so we have to do a generic get here.
     var index = UnsafeGetReservedSlot(this, ITERATOR_SLOT_NEXT_INDEX);
-
-    // Step 7.
     var itemKind = UnsafeGetInt32FromReservedSlot(this, ITERATOR_SLOT_ITEM_KIND);
-
-    // Step 8-9.
+    var result = { value: undefined, done: false };
     var len = IsPossiblyWrappedTypedArray(a)
               ? PossiblyWrappedTypedArrayLength(a)
               : TO_UINT32(a.length);
 
-    // Step 10.
+    // FIXME: This should be ToLength, which clamps at 2**53.  Bug 924058.
     if (index >= len) {
-        UnsafeSetReservedSlot(this, ITERATOR_SLOT_TARGET, null);
+        // When the above is changed to ToLength, use +1/0 here instead
+        // of MAX_UINT32.
+        UnsafeSetReservedSlot(this, ITERATOR_SLOT_NEXT_INDEX, 0xffffffff);
         result.done = true;
         return result;
     }
 
-    // Step 11.
     UnsafeSetReservedSlot(this, ITERATOR_SLOT_NEXT_INDEX, index + 1);
 
-    // Step 16.
     if (itemKind === ITEM_KIND_VALUE) {
         result.value = a[index];
         return result;
     }
 
-    // Step 13.
     if (itemKind === ITEM_KIND_KEY_AND_VALUE) {
         var pair = [index, a[index]];
         result.value = pair;
         return result;
     }
 
-    // Step 12.
     assert(itemKind === ITEM_KIND_KEY, itemKind);
     result.value = index;
     return result;
 }
 
 function ArrayValuesAt(n) {
     return CreateArrayIteratorAt(this, ITEM_KIND_VALUE, n);
 }

deleted file mode 100644
--- a/js/src/tests/ecma_6/Array/iterator_next.js
+++ /dev/null
@@ -1,23 +0,0 @@
-function testIteratorNextGetLength() {
-  var lengthCalledTimes = 0;
-  var array = {
-    __proto__: Array.prototype,
-    get length() {
-      lengthCalledTimes += 1;
-      return {
-        valueOf() {
-          return 0;
-        }
-      };
-    }
-  };
-  var it = array[Symbol.iterator]();
-  it.next();
-  it.next();
-  if (typeof reportCompare === 'function') {
-    reportCompare(1, lengthCalledTimes,
-      "when an iterator get length zero, it shouldn't access it again");
-  }
-}
-testIteratorNextGetLength();
-