Step 13 of %ArrayIteratorPrototype%.next() checks if itemKind has the substring "value", and ultimately returns if it does. Step 14 checks if itemKind has the substring "key+value", and returns a different result based on that.
However, because "value" is itself a substring of "key+value", an ArrayIterator of kind "key+value" (intended to trip Step 14) will never reach the right step, because it will trip Step 13 and return before that can happen.
This can be fixed simply by swapping the two steps. Then kind "key+value" will trip the appropriate step, but other kinds of iterators will pass through to the other checks.
I don't think so, step 13c only returns if step 13b throws an exception, otherwise it just continues with step 14 (no else in front of step 14)
Step 13 is doing the elementValue fetch for both the "value" and "key+value" cases
substring testing eliminated as part of fix for Bug 2736
In rev25