--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -1784,28 +1784,16 @@ HandleLexicalCheckFailure(JSContext* cx,
     if (!innerScript->failedLexicalCheck())
         innerScript->setFailedLexicalCheck();
 
     InvalidateAfterBailout(cx, outerScript, "lexical check failure");
     if (innerScript->hasIonScript())
         Invalidate(cx, innerScript);
 }
 
-static void
-HandleIterNextNonStringBailout(JSContext* cx, HandleScript outerScript, HandleScript innerScript)
-{
-    JitSpew(JitSpew_IonBailouts, "Non-string iterator value %s:%zu, inlined into %s:%zu",
-            innerScript->filename(), innerScript->lineno(),
-            outerScript->filename(), outerScript->lineno());
-
-    // This should only happen when legacy generators are used.
-    ForbidCompilation(cx, innerScript);
-    InvalidateAfterBailout(cx, outerScript, "non-string iterator value");
-}
-
 static bool
 CopyFromRematerializedFrame(JSContext* cx, JitActivation* act, uint8_t* fp, size_t inlineDepth,
                             BaselineFrame* frame)
 {
     RematerializedFrame* rematFrame = act->lookupRematerializedFrame(fp, inlineDepth);
 
     // We might not have rematerialized a frame if the user never requested a
     // Debugger.Frame for it.
@@ -2036,20 +2024,16 @@ jit::FinishBailoutToBaseline(BaselineBai
       case Bailout_OverflowInvalidate:
         outerScript->setHadOverflowBailout();
         MOZ_FALLTHROUGH;
       case Bailout_DoubleOutput:
       case Bailout_ObjectIdentityOrTypeGuard:
         HandleBaselineInfoBailout(cx, outerScript, innerScript);
         break;
 
-      case Bailout_IterNextNonString:
-        HandleIterNextNonStringBailout(cx, outerScript, innerScript);
-        break;
-
       case Bailout_ArgumentCheck:
         // Do nothing, bailout will resume before the argument monitor ICs.
         break;
       case Bailout_BoundsCheck:
       case Bailout_Detached:
         HandleBoundsCheckFailure(cx, outerScript, innerScript);
         break;
       case Bailout_ShapeGuard:

--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -12624,21 +12624,18 @@ IonBuilder::jsop_iterend()
 }
 
 AbortReasonOr<Ok>
 IonBuilder::jsop_iternext()
 {
     MDefinition* def = current->pop();
     MOZ_ASSERT(def->type() == MIRType::Value);
 
-    // The value should be a string in most cases. Legacy generators can return
-    // non-string values, so in that case bailout and give up Ion compilation
-    // of the script.
-    MInstruction* unbox = MUnbox::New(alloc(), def, MIRType::String, MUnbox::Fallible,
-                                      Bailout_IterNextNonString);
+    // The value must be a string.
+    MInstruction* unbox = MUnbox::New(alloc(), def, MIRType::String, MUnbox::Infallible);
     current->add(unbox);
     current->push(unbox);
 
     return Ok();
 }
 
 MDefinition*
 IonBuilder::walkEnvironmentChain(unsigned hops)

--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@@ -127,20 +127,16 @@ enum BailoutKind
     // END Normal bailouts
 
     // Bailouts caused by invalid assumptions based on Baseline code.
     // Causes immediate invalidation.
 
     // Like Bailout_Overflow, but causes immediate invalidation.
     Bailout_OverflowInvalidate,
 
-    // Like NonStringInput, but should cause immediate invalidation.
-    // Used for jsop_iternext.
-    Bailout_IterNextNonString,
-
     // Used for integer division, multiplication and modulo.
     // If there's a remainder, bails to return a double.
     // Can also signal overflow or result of -0.
     // Can also signal division by 0 (returns inf, a double).
     Bailout_DoubleOutput,
 
     // END Invalid assumptions bailouts
 
@@ -224,18 +220,16 @@ BailoutKindString(BailoutKind kind)
       case Bailout_BadDerivedConstructorReturn:
         return "Bailout_BadDerivedConstructorReturn";
       case Bailout_FirstExecution:
         return "Bailout_FirstExecution";
 
       // Bailouts caused by invalid assumptions.
       case Bailout_OverflowInvalidate:
         return "Bailout_OverflowInvalidate";
-      case Bailout_IterNextNonString:
-        return "Bailout_IterNextNonString";
       case Bailout_DoubleOutput:
         return "Bailout_DoubleOutput";
 
       // Other bailouts.
       case Bailout_ArgumentCheck:
         return "Bailout_ArgumentCheck";
       case Bailout_BoundsCheck:
         return "Bailout_BoundsCheck";

--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -1972,17 +1972,16 @@ CASE(EnableInterruptsPseudoOpcode)
     SANITY_CHECKS();
     DISPATCH_TO(op);
 }
 
 /* Various 1-byte no-ops. */
 CASE(JSOP_NOP)
 CASE(JSOP_NOP_DESTRUCTURING)
 CASE(JSOP_TRY_DESTRUCTURING_ITERCLOSE)
-CASE(JSOP_ITERNEXT)
 CASE(JSOP_UNUSED126)
 CASE(JSOP_UNUSED223)
 CASE(JSOP_CONDSWITCH)
 {
     MOZ_ASSERT(CodeSpec[*REGS.pc].length == 1);
     ADVANCE_AND_DISPATCH(1);
 }
 
@@ -2279,16 +2278,23 @@ END_CASE(JSOP_ENDITER)
 
 CASE(JSOP_ISGENCLOSING)
 {
     bool b = REGS.sp[-1].isMagic(JS_GENERATOR_CLOSING);
     PUSH_BOOLEAN(b);
 }
 END_CASE(JSOP_ISGENCLOSING)
 
+CASE(JSOP_ITERNEXT)
+{
+    // Ion relies on this.
+    MOZ_ASSERT(REGS.sp[-1].isString());
+}
+END_CASE(JSOP_ITERNEXT)
+
 CASE(JSOP_DUP)
 {
     MOZ_ASSERT(REGS.stackDepth() >= 1);
     const Value& rref = REGS.sp[-1];
     PUSH_COPY(rref);
 }
 END_CASE(JSOP_DUP)