Index: Source/GSArray.m
===================================================================
--- Source/GSArray.m	(revision 27769)
+++ Source/GSArray.m	(working copy)
@@ -373,8 +373,11 @@
 				     count: (NSUInteger)len
 {
   /* For immutable arrays we can return the contents pointer directly. */
-  state->itemsPtr = _contents_array;
-  return _count;
+  NSUInteger count = _count - state->state;
+  state->mutationsPtr = (unsigned long *)self;
+  state->itemsPtr = _contents_array + state->state;
+  state->state += count;
+  return count;
 }
 @end
 
@@ -903,15 +906,15 @@
    * iteration.   If it changes during the iteration then
    * objc_enumerationMutation() will be called, throwing an exception.
    */
-  state->mutationsPtr = (unsigned long*)_version;
+  state->mutationsPtr = (unsigned long *)&_version;
   count = MIN(len, _count - state->state);
   /* If a mutation has occurred then it's possible that we are being asked to
    * get objects from after the end of the array.  Don't pass negative values
    * to memcpy.
    */
-  if (count <= 0)
+  if (count >= 0)
     {
-      memcpy(stackbuf, _contents_array, count);
+      memcpy(stackbuf, _contents_array + state->state, count * sizeof(id));
       state->state += count;
     }
   else
Index: Source/NSEnumerator.m
===================================================================
--- Source/NSEnumerator.m	(revision 27769)
+++ Source/NSEnumerator.m	(working copy)
@@ -81,6 +81,8 @@
   IMP nextObject = [self methodForSelector: @selector(nextObject)];
   int i;
 
+  state->itemsPtr = stackbuf;
+  state->mutationsPtr = (unsigned long*)self;
   for (i = 0; i < len; i++)
     {
       id next = nextObject(self, @selector(nextObject));
@@ -91,7 +93,6 @@
 	}
       *(stackbuf+i) = next;
     }
-  state->itemsPtr = stackbuf;
   return len;
 }
 @end