diff --git a/js/src/jit/IonFrameIterator.h b/js/src/jit/IonFrameIterator.h
index 83486d5fa629..220725f7eb06 100644
--- a/js/src/jit/IonFrameIterator.h
+++ b/js/src/jit/IonFrameIterator.h
@@ -237,8 +237,13 @@ class SnapshotIterator : public SnapshotReader
     IonScript *ionScript_;
 
   private:
-    bool hasLocation(const Location &loc);
-    uintptr_t fromLocation(const Location &loc);
+    // Read a spilled register from the machine state.
+    bool hasRegister(const Location &loc);
+    uintptr_t fromRegister(const Location &loc);
+
+    // Read an uintptr_t from the stack.
+    bool hasStack(const Location &loc);
+    uintptr_t fromStack(const Location &loc);
 
     Value slotValue(const Slot &slot);
     bool slotReadable(const Slot &slot);
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index 70792c823969..98049020fa41 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -1319,19 +1319,30 @@ SnapshotIterator::SnapshotIterator()
 }
 
 bool
-SnapshotIterator::hasLocation(const Location &loc)
+SnapshotIterator::hasRegister(const Location &loc)
 {
-    return loc.isStackSlot() || machine_.has(loc.reg());
+    return machine_.has(loc.reg());
 }
 
 uintptr_t
-SnapshotIterator::fromLocation(const Location &loc)
+SnapshotIterator::fromRegister(const Location &loc)
 {
-    if (loc.isStackSlot())
-        return ReadFrameSlot(fp_, loc.stackSlot());
     return machine_.read(loc.reg());
 }
 
+bool
+SnapshotIterator::hasStack(const Location &loc)
+{
+    JS_ASSERT(loc.isStackSlot());
+    return true;
+}
+
+uintptr_t
+SnapshotIterator::fromStack(const Location &loc)
+{
+    return ReadFrameSlot(fp_, loc.stackSlot());
+}
+
 static Value
 FromObjectPayload(uintptr_t payload)
 {
@@ -1373,14 +1384,18 @@ SnapshotIterator::slotReadable(const Slot &slot)
 
 #if defined(JS_NUNBOX32)
       case Slot::UNTYPED_REG_REG:
+        return hasRegister(slot.type()) && hasRegister(slot.payload());
       case Slot::UNTYPED_REG_STACK:
+        return hasRegister(slot.type()) && hasStack(slot.payload());
       case Slot::UNTYPED_STACK_REG:
+        return hasStack(slot.type()) && hasRegister(slot.payload());
       case Slot::UNTYPED_STACK_STACK:
-        return hasLocation(slot.type()) && hasLocation(slot.payload());
+        return hasStack(slot.type()) && hasStack(slot.payload());
 #elif defined(JS_PUNBOX64)
       case Slot::UNTYPED_REG:
+        return hasRegister(slot.value());
       case Slot::UNTYPED_STACK:
-        return hasLocation(slot.value());
+        return hasStack(slot.value());
 #endif
 
       default:
@@ -1433,21 +1448,48 @@ SnapshotIterator::slotValue(const Slot &slot)
 
 #if defined(JS_NUNBOX32)
       case Slot::UNTYPED_REG_REG:
+      {
+        jsval_layout layout;
+        layout.s.tag = (JSValueTag) fromRegister(slot.type());
+        layout.s.payload.word = fromRegister(slot.payload());
+        return IMPL_TO_JSVAL(layout);
+      }
+
       case Slot::UNTYPED_REG_STACK:
+      {
+        jsval_layout layout;
+        layout.s.tag = (JSValueTag) fromRegister(slot.type());
+        layout.s.payload.word = fromStack(slot.payload());
+        return IMPL_TO_JSVAL(layout);
+      }
+
       case Slot::UNTYPED_STACK_REG:
+      {
+        jsval_layout layout;
+        layout.s.tag = (JSValueTag) fromStack(slot.type());
+        layout.s.payload.word = fromRegister(slot.payload());
+        return IMPL_TO_JSVAL(layout);
+      }
+
       case Slot::UNTYPED_STACK_STACK:
       {
         jsval_layout layout;
-        layout.s.tag = (JSValueTag)fromLocation(slot.type());
-        layout.s.payload.word = fromLocation(slot.payload());
+        layout.s.tag = (JSValueTag) fromStack(slot.type());
+        layout.s.payload.word = fromStack(slot.payload());
         return IMPL_TO_JSVAL(layout);
       }
 #elif defined(JS_PUNBOX64)
       case Slot::UNTYPED_REG:
+      {
+        jsval_layout layout;
+        layout.asBits = fromRegister(slot.value());
+        return IMPL_TO_JSVAL(layout);
+      }
+
       case Slot::UNTYPED_STACK:
       {
         jsval_layout layout;
-        layout.asBits = fromLocation(slot.value());
+        layout.asBits = fromStack(slot.value());
         return IMPL_TO_JSVAL(layout);
       }
 #endif