Fix old bug that stored iter_state even after OBJ_ENUMERATE error (55201, r=rogerl, a=jband).

js/src/jsinterp.c

@@ -1626,7 +1626,6 @@ js_Interpret(JSContext *cx, jsval *result)
                 *vp = OBJECT_TO_JSVAL(propobj);
 
                 ok = OBJ_ENUMERATE(cx, obj, JSENUMERATE_INIT, &iter_state, 0);
-                propobj->slots[JSSLOT_ITER_STATE] = iter_state;
                 if (!ok)
                     goto out;
 
@@ -1638,6 +1637,7 @@ js_Interpret(JSContext *cx, jsval *result)
 #error JS_INITIAL_NSLOTS must be greater than or equal to 5.
 #endif
                 propobj->slots[JSSLOT_PARENT] = OBJECT_TO_JSVAL(obj);
+                propobj->slots[JSSLOT_ITER_STATE] = iter_state;
             } else {
                 /* This is not the first iteration. Recover iterator state. */
                 propobj = JSVAL_TO_OBJECT(rval);