Fix stack frame reconstruction for generators with formal arguments

The formal parameter count was always being treated as an untagged
integer, but it is actually a Smi on ia32 and arm.

R=mstarzinger@chromium.org
BUG=v8:2355
TEST=mjsunit/harmony/generators-iteration

Review URL: https://codereview.chromium.org/17485002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/arm/full-codegen-arm.cc b/src/arm/full-codegen-arm.cc
index 77d5524..cd88010 100644 (file)
--- a/src/arm/full-codegen-arm.cc
+++ b/src/arm/full-codegen-arm.cc
@@ -2132,7 +2132,7 @@ void FullCodeGenerator::EmitGeneratorResume(Expression *generator,
   __ LoadRoot(r2, Heap::kTheHoleValueRootIndex);
   Label push_argument_holes, push_frame;
   __ bind(&push_argument_holes);
-  __ sub(r3, r3, Operand(1), SetCC);
+  __ sub(r3, r3, Operand(Smi::FromInt(1)), SetCC);
   __ b(mi, &push_frame);
   __ push(r2);
   __ jmp(&push_argument_holes);

diff --git a/src/ia32/full-codegen-ia32.cc b/src/ia32/full-codegen-ia32.cc
index 54e9eaf..5ce7686 100644 (file)
--- a/src/ia32/full-codegen-ia32.cc
+++ b/src/ia32/full-codegen-ia32.cc
@@ -2091,7 +2091,7 @@ void FullCodeGenerator::EmitGeneratorResume(Expression *generator,
   __ mov(ecx, isolate()->factory()->the_hole_value());
   Label push_argument_holes, push_frame;
   __ bind(&push_argument_holes);
-  __ sub(edx, Immediate(1));
+  __ sub(edx, Immediate(Smi::FromInt(1)));
   __ j(carry, &push_frame);
   __ push(ecx);
   __ jmp(&push_argument_holes);

diff --git a/test/mjsunit/harmony/generators-iteration.js b/test/mjsunit/harmony/generators-iteration.js
index dc210d5..7fad97e 100644 (file)
--- a/test/mjsunit/harmony/generators-iteration.js
+++ b/test/mjsunit/harmony/generators-iteration.js
@@ -346,6 +346,15 @@ TestGenerator(
     "foo",
     [3, undefined]);
 
+// Access to this with formal arguments.
+TestGenerator(
+    function () {
+      return ({ x: 42, g: function* (a) { yield this.x } }).g(0);
+    },
+    [42, undefined],
+    "foo",
+    [42, undefined]);
+
 // Test that yield* re-yields received results without re-boxing.
 function TestDelegatingYield() {
   function results(results) {