diff --git a/src/lj_tab.c b/src/lj_tab.c
index 40f75269..33d6d75b 100644
--- a/src/lj_tab.c
+++ b/src/lj_tab.c
@@ -545,6 +545,8 @@ static uint32_t keyindex(lua_State *L, GCtab *t, cTValue *key)
 	return t->asize + (uint32_t)(n - noderef(t->node));
 	/* Hash key indexes: [t->asize..t->asize+t->nmask] */
     } while ((n = nextnode(n)));
+    if (key->u32.hi == 0xfffe7fff)  /* ITERN was despecialized while running. */
+      return key->u32.lo - 1;
     lj_err_msg(L, LJ_ERR_NEXTIDX);
     return 0;  /* unreachable */
   }
diff --git a/src/vm_arm.dasc b/src/vm_arm.dasc
index b2c15f49..31657b70 100644
--- a/src/vm_arm.dasc
+++ b/src/vm_arm.dasc
@@ -3897,7 +3897,8 @@ static void build_ins(BuildCtx *ctx, BCOp op, int defop)
     |   ins_next1
     |   ins_next2
     |  mov CARG1, #0
-    |  str CARG1, [RA, #-8]		// Initialize control var.
+    |  mvn CARG2, #0x00018000
+    |  strd CARG1, [RA, #-8]		// Initialize control var.
     |1:
     |   ins_next3
     |5:  // Despecialize bytecode if any of the checks fail.
diff --git a/src/vm_mips.dasc b/src/vm_mips.dasc
index 6da7d4d2..fdf07343 100644
--- a/src/vm_mips.dasc
+++ b/src/vm_mips.dasc
@@ -3617,7 +3617,10 @@ static void build_ins(BuildCtx *ctx, BCOp op, int defop)
     |  bnez TMP1, >5
     |.  lui TMP2, (-(BCBIAS_J*4 >> 16) & 65535)
     |  addu PC, TMP0, TMP2
+    |  lui TMP1, 0xfffe
+    |  ori TMP1, TMP1, 0x7fff
     |  sw r0, -8+LO(RA)			// Initialize control var.
+    |  sw TMP1, -8+HI(RA)
     |1:
     |  ins_next
     |5:  // Despecialize bytecode if any of the checks fail.
diff --git a/src/vm_ppc.dasc b/src/vm_ppc.dasc
index 1a7c31ad..7c567aad 100644
--- a/src/vm_ppc.dasc
+++ b/src/vm_ppc.dasc
@@ -4376,7 +4376,10 @@ static void build_ins(BuildCtx *ctx, BCOp op, int defop)
     |  crand 4*cr0+eq, 4*cr0+eq, 4*cr7+eq
     |    add TMP3, PC, TMP0
     |  bne cr0, >5
+    |  lus TMP1, 0xfffe
+    |  ori TMP1, TMP1, 0x7fff
     |  stw ZERO, -4(RA)			// Initialize control var.
+    |  stw TMP1, -8(RA)
     |    addis PC, TMP3, -(BCBIAS_J*4 >> 16)
     |1:
     |  ins_next
diff --git a/src/vm_ppcspe.dasc b/src/vm_ppcspe.dasc
index 31e4c6c4..0adbcd7e 100644
--- a/src/vm_ppcspe.dasc
+++ b/src/vm_ppcspe.dasc
@@ -3188,7 +3188,10 @@ static void build_ins(BuildCtx *ctx, BCOp op, int defop)
     |  crand 4*cr0+eq, 4*cr0+eq, 4*cr7+eq
     |    add TMP3, PC, TMP0
     |  bne cr0, >5
+    |  lus TMP1, 0xfffe
+    |  ori TMP1, TMP1, 0x7fff
     |  stw ZERO, -4(RA)			// Initialize control var.
+    |  stw TMP1, -8(RA)
     |    addis PC, TMP3, -(BCBIAS_J*4 >> 16)
     |1:
     |  ins_next
diff --git a/src/vm_x86.dasc b/src/vm_x86.dasc
index 8fe07a65..67984c6c 100644
--- a/src/vm_x86.dasc
+++ b/src/vm_x86.dasc
@@ -1566,7 +1566,7 @@ static void build_subroutines(BuildCtx *ctx)
   |  add BASE, 8
   |  mov ARG3, BASE
   |.endif
-  |  mov SAVE_PC, PC			// Redundant (but a defined value).
+  |  mov SAVE_PC, PC			// Needed for ITERN fallback.
   |  call extern lj_tab_next	// (lua_State *L, GCtab *t, TValue *key)
   |  // Flag returned in eax (RD).
   |  mov BASE, L:RB->base
@@ -5433,6 +5433,7 @@ static void build_ins(BuildCtx *ctx, BCOp op, int defop)
     |  cmp byte CFUNC:RB->ffid, FF_next_N; jne >5
     |  branchPC RD
     |  mov dword [BASE+RA*8-8], 0	// Initialize control var.
+    |  mov dword [BASE+RA*8-4], 0xfffe7fff
     |1:
     |  ins_next
     |5:  // Despecialize bytecode if any of the checks fail.