530879 - generators get incorrect arguments.length

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Donny Viszneki]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.15) Gecko/2009102815 Ubuntu/9.04 (jaunty) Firefox/3.0.15
Build Identifier: revision 2f75734c2211 and others

Generators seem to get an incorrect arguments.length. It seems that arguments.length is always the length of the argument vector in the generator function's definition, not the length of the argument vector from the generator's constructor invocation.

Reproducible: Always

Steps to Reproduce:
js -e 'print((function(a,b,c,d){yield arguments.length})().next()===4)'
Actual Results:  
true

Expected Results:  
false

Have a nice day :)

Comment 1

[Brendan Eich [:brendan]]

Thanks, Donny. Gives false in 1.9.0 (firefox 3) era js shell. Did this regress recently? Any bisect help appreciated.

/be

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 3

[Jason Orendorff [:jorendorff]]

Comment on attachment 415741 [details] [diff] [review]
v1

Introduced here:

http://hg.mozilla.org/tracemonkey/diff/471f34aa61df/js/src/jsiter.cpp

The code used to say

  gen->frame.argc = argc;

not nargs, but that was obscured by a macro.

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 415741 [details] [diff] [review]
v1

Nice, thanks for patching. And thanks again to Donny for noticing!

/be

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/8abbf11c0724