Reviewers: Michael Starzinger, rossberg,
Description:
Fix stack frame reconstruction for generators with formal arguments
The formal parameter count was always being treated as an untagged
integer, but it is actually a Smi on ia32 and arm.
[email protected]
BUG=v8:2355
TEST=mjsunit/harmony/generators-iteration
Please review this at https://codereview.chromium.org/17485002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/arm/full-codegen-arm.cc
M src/ia32/full-codegen-ia32.cc
M test/mjsunit/harmony/generators-iteration.js
Index: src/arm/full-codegen-arm.cc
diff --git a/src/arm/full-codegen-arm.cc b/src/arm/full-codegen-arm.cc
index
77d5524aa9aa63fcaae95214b74eb7a493393632..cd880105336ba4722d29759e52ccca1b9c10f7c9
100644
--- a/src/arm/full-codegen-arm.cc
+++ b/src/arm/full-codegen-arm.cc
@@ -2132,7 +2132,7 @@ void
FullCodeGenerator::EmitGeneratorResume(Expression *generator,
__ LoadRoot(r2, Heap::kTheHoleValueRootIndex);
Label push_argument_holes, push_frame;
__ bind(&push_argument_holes);
- __ sub(r3, r3, Operand(1), SetCC);
+ __ sub(r3, r3, Operand(Smi::FromInt(1)), SetCC);
__ b(mi, &push_frame);
__ push(r2);
__ jmp(&push_argument_holes);
Index: src/ia32/full-codegen-ia32.cc
diff --git a/src/ia32/full-codegen-ia32.cc b/src/ia32/full-codegen-ia32.cc
index
54e9eaf1d60969a65cd0ac17dd852e1a3bcf411e..5ce7686e3c384d97ceff946b01b196ca8e1733e0
100644
--- a/src/ia32/full-codegen-ia32.cc
+++ b/src/ia32/full-codegen-ia32.cc
@@ -2091,7 +2091,7 @@ void
FullCodeGenerator::EmitGeneratorResume(Expression *generator,
__ mov(ecx, isolate()->factory()->the_hole_value());
Label push_argument_holes, push_frame;
__ bind(&push_argument_holes);
- __ sub(edx, Immediate(1));
+ __ sub(edx, Immediate(Smi::FromInt(1)));
__ j(carry, &push_frame);
__ push(ecx);
__ jmp(&push_argument_holes);
Index: test/mjsunit/harmony/generators-iteration.js
diff --git a/test/mjsunit/harmony/generators-iteration.js
b/test/mjsunit/harmony/generators-iteration.js
index
dc210d5b1167521c833365e4a120ed8a6fc45439..7fad97e9445ce1f5b4a85180be3e6b013c2789fa
100644
--- a/test/mjsunit/harmony/generators-iteration.js
+++ b/test/mjsunit/harmony/generators-iteration.js
@@ -346,6 +346,15 @@ TestGenerator(
"foo",
[3, undefined]);
+// Access to this with formal arguments.
+TestGenerator(
+ function () {
+ return ({ x: 42, g: function* (a) { yield this.x } }).g(0);
+ },
+ [42, undefined],
+ "foo",
+ [42, undefined]);
+
// Test that yield* re-yields received results without re-boxing.
function TestDelegatingYield() {
function results(results) {
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
