From f7ba3a7bb1e4b7e8849f7962a2857f50ee2f6b78 Mon Sep 17 00:00:00 2001 From: "wingo@igalia.com" Date: Thu, 20 Jun 2013 10:48:34 +0000 Subject: [PATCH] Fix stack frame reconstruction for generators with formal arguments The formal parameter count was always being treated as an untagged integer, but it is actually a Smi on ia32 and arm. R=mstarzinger@chromium.org BUG=v8:2355 TEST=mjsunit/harmony/generators-iteration Review URL: https://codereview.chromium.org/17485002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/arm/full-codegen-arm.cc | 2 +- src/ia32/full-codegen-ia32.cc | 2 +- test/mjsunit/harmony/generators-iteration.js | 9 +++++++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/src/arm/full-codegen-arm.cc b/src/arm/full-codegen-arm.cc index 77d5524..cd88010 100644 --- a/src/arm/full-codegen-arm.cc +++ b/src/arm/full-codegen-arm.cc @@ -2132,7 +2132,7 @@ void FullCodeGenerator::EmitGeneratorResume(Expression *generator, __ LoadRoot(r2, Heap::kTheHoleValueRootIndex); Label push_argument_holes, push_frame; __ bind(&push_argument_holes); - __ sub(r3, r3, Operand(1), SetCC); + __ sub(r3, r3, Operand(Smi::FromInt(1)), SetCC); __ b(mi, &push_frame); __ push(r2); __ jmp(&push_argument_holes); diff --git a/src/ia32/full-codegen-ia32.cc b/src/ia32/full-codegen-ia32.cc index 54e9eaf..5ce7686 100644 --- a/src/ia32/full-codegen-ia32.cc +++ b/src/ia32/full-codegen-ia32.cc @@ -2091,7 +2091,7 @@ void FullCodeGenerator::EmitGeneratorResume(Expression *generator, __ mov(ecx, isolate()->factory()->the_hole_value()); Label push_argument_holes, push_frame; __ bind(&push_argument_holes); - __ sub(edx, Immediate(1)); + __ sub(edx, Immediate(Smi::FromInt(1))); __ j(carry, &push_frame); __ push(ecx); __ jmp(&push_argument_holes); diff --git a/test/mjsunit/harmony/generators-iteration.js b/test/mjsunit/harmony/generators-iteration.js index dc210d5..7fad97e 100644 --- a/test/mjsunit/harmony/generators-iteration.js +++ b/test/mjsunit/harmony/generators-iteration.js @@ -346,6 +346,15 @@ TestGenerator( "foo", [3, undefined]); +// Access to this with formal arguments. +TestGenerator( + function () { + return ({ x: 42, g: function* (a) { yield this.x } }).g(0); + }, + [42, undefined], + "foo", + [42, undefined]); + // Test that yield* re-yields received results without re-boxing. function TestDelegatingYield() { function results(results) { -- 2.7.4