Bug 530879 - Generators get incorrect arguments.length. Discovered by Donny Viszneki. r=brendan.

This commit is contained in:
Jason Orendorff 2009-12-03 16:12:09 -06:00
parent 90477b6487
commit b46379b4f6
3 changed files with 12 additions and 1 deletions

View File

@ -766,7 +766,7 @@ js_NewGenerator(JSContext *cx, JSStackFrame *fp)
/* Copy rval, argv and vars. */
gen->frame.rval = fp->rval;
memcpy(slots, fp->argv - 2, (2 + nargs) * sizeof(jsval));
gen->frame.argc = nargs;
gen->frame.argc = fp->argc;
gen->frame.argv = slots + 2;
slots += 2 + nargs;
memcpy(slots, fp->slots, fp->script->nfixed * sizeof(jsval));

View File

@ -83,3 +83,4 @@ script regress-515885.js
skip-if(isDebugBuild&&!xulRuntime.shell) script regress-524743.js # hang
script regress-522123.js
script regress-524264.js
script regress-530879.js

View File

@ -0,0 +1,10 @@
/*
* Any copyright is dedicated to the Public Domain.
* http://creativecommons.org/licenses/publicdomain/
* Contributor: Jason Orendorff
*/
gTestfile = 'regress-530879';
function f(a, b, c, d) {
yield arguments.length;
}
reportCompare(0, f().next(), "bug 530879");