diff -r a6e59a2e880e Objects/dictobject.c
--- a/Objects/dictobject.c	Mon Oct 31 22:54:12 2016 -0700
+++ b/Objects/dictobject.c	Wed Nov 02 01:24:56 2016 +0800
@@ -1700,7 +1700,7 @@
 _PyDict_Next(PyObject *op, Py_ssize_t *ppos, PyObject **pkey,
              PyObject **pvalue, Py_hash_t *phash)
 {
-    Py_ssize_t i, n;
+    Py_ssize_t i;
     PyDictObject *mp;
     PyDictKeyEntry *entry_ptr;
     PyObject *value;
@@ -1709,21 +1709,20 @@
         return 0;
     mp = (PyDictObject *)op;
     i = *ppos;
-    n = mp->ma_keys->dk_nentries;
-    if ((size_t)i >= (size_t)n)
-        return 0;
     if (mp->ma_values) {
-        PyObject **value_ptr = &mp->ma_values[i];
-        while (i < n && *value_ptr == NULL) {
-            value_ptr++;
-            i++;
-        }
-        if (i >= n)
+        PyObject **value_ptr;
+        if ((size_t)i >= (size_t)mp->ma_used)
             return 0;
+        /* values of split table is always dense */
+        value_ptr = &mp->ma_values[i];
+        assert(*value_ptr != NULL);
         entry_ptr = &DK_ENTRIES(mp->ma_keys)[i];
         value = *value_ptr;
     }
     else {
+        Py_ssize_t n = mp->ma_keys->dk_nentries;
+        if ((size_t)i >= (size_t)n)
+            return 0;
         entry_ptr = &DK_ENTRIES(mp->ma_keys)[i];
         while (i < n && entry_ptr->me_value == NULL) {
             entry_ptr++;