--- a/js/src/ion/IonFrames.cpp
+++ b/js/src/ion/IonFrames.cpp
@@ -265,26 +265,25 @@ IonFrameIterator::machineState() const
             continue;
         machine.setRegisterLocation(reg, spillBase);
     }
 
     return machine;
 }
 
 static void
-CloseLiveIterator(JSContext *cx, const InlineFrameIterator &frame, uint32 stackSlot)
+CloseLiveIterator(JSContext *cx, const InlineFrameIterator &frame, uint32 localSlot)
 {
     SnapshotIterator si = frame.snapshotIterator();
 
-    // Skip stuff that comes before locals.
-    for (unsigned i = 0; i < CountArgSlots(frame.maybeCallee()); i++)
-        si.skip();
+    // Skip stack slots until we reach the iterator object.
+    uint32 base = CountArgSlots(frame.maybeCallee()) + frame.script()->nfixed;
+    uint32 skipSlots = base + localSlot - 1;
 
-    // Skip stack slots until we reach the iterator object.
-    for (unsigned i = 0; i < stackSlot; i++)
+    for (unsigned i = 0; i < skipSlots; i++)
         si.skip();
 
     Value v = si.read();
     JSObject *obj = &v.toObject();
 
     if (cx->isExceptionPending())
         UnwindIteratorForUncatchableException(cx, obj);
     else
@@ -299,26 +298,29 @@ CloseLiveIterators(JSContext *cx, const 
 
     if (!JSScript::isValidOffset(script->trynotesOffset))
         return;
 
     JSTryNote *tn = script->trynotes()->vector;
     JSTryNote *tnEnd = tn + script->trynotes()->length;
 
     for (; tn != tnEnd; ++tn) {
-        if (uint32(pc - script->code) - tn->start >= tn->length)
+        if (uint32(pc - script->code) < tn->start)
+            continue;
+        if (uint32(pc - script->code) >= tn->start + tn->length)
             continue;
 
         if (tn->kind != JSTRY_ITER)
             continue;
 
         JS_ASSERT(JSOp(*(script->code + tn->start + tn->length)) == JSOP_ENDITER);
         JS_ASSERT(tn->stackDepth > 0);
 
-        CloseLiveIterator(cx, frame, tn->stackDepth - 1);
+        uint32 localSlot = tn->stackDepth;
+        CloseLiveIterator(cx, frame, localSlot);
     }
 }
 
 void
 ion::HandleException(ResumeFromException *rfe)
 {
     JSContext *cx = GetIonContext()->cx;