Bug 852016 - Watch for uses of 'arguments' in eval() inside generator expressions, r=luke.

js/src/frontend/BytecodeCompiler.cpp

@@ -66,6 +66,12 @@ CheckArgumentsWithinEval(JSContext *cx, Parser<FullParseHandler> &parser, Handle
             return false;
     }
 
+    // It's an error to use |arguments| in a generator expression.
+    if (script->isGeneratorExp) {
+        parser.report(ParseError, false, NULL, JSMSG_BAD_GENEXP_BODY, js_arguments_str);
+        return false;
+    }
+
     return true;
 }
 

js/src/jit-test/tests/basic/bug852016-2.js

@@ -0,0 +1,8 @@
+
+function foo(str) {
+  var x = eval(str); yield x[0];
+}
+for (var i = 0; i < 5; i++)
+  assertEq(foo("[4,5,6]").next(), 4);
+for (var i = 0; i < 5; i++)
+  assertEq(foo("arguments").next(), "arguments");

js/src/jit-test/tests/basic/bug852016.js

@@ -0,0 +1,9 @@
+//|jit-test| error: SyntaxError
+
+(function() {
+    x = "arguments";
+    f = eval("(function(){return(c for (x in eval('print(arguments[0])')))})");
+    for (e in f()) {
+        (function() {});
+    }
+})(3)