Deal with a function in a generator passing too few arguments and with calling the result of 'yield'. Patch from brendan, r=mrbkap, bug 345879

js/src/jsinterp.c

@@ -2173,7 +2173,9 @@ js_Interpret(JSContext *cx, jsbytecode *pc, jsval *result)
 
     /*
      * To support generator_throw and to catch ignored exceptions, fail right
-     * away if cx->throwing is set.
+     * away if cx->throwing is set.  If no exception is pending, null obj in
+     * case a callable object is being sent into a yield expression, and the
+     * yield's result is invoked.
      */
     ok = !cx->throwing;
     if (!ok) {
@@ -2183,6 +2185,7 @@ js_Interpret(JSContext *cx, jsbytecode *pc, jsval *result)
 #endif
         goto out;
     }
+    obj = NULL;
 
 #ifdef JS_THREADED_INTERP
 
@@ -2283,12 +2286,6 @@ interrupt:
           EMPTY_CASE(JSOP_GROUP)
 
           BEGIN_CASE(JSOP_PUSH)
-            /*
-             * Clear for-in loop flags in case we are pushing an old-style
-             * iterator slot.  XXX remove this if we can prevent old XDR'd
-             * bytecode from being deserialized and executed
-             */
-            flags = 0;
             PUSH_OPND(JSVAL_VOID);
           END_CASE(JSOP_PUSH)
 

js/src/jsiter.c

@@ -620,6 +620,7 @@ typedef enum JSGeneratorState {
 typedef struct JSGenerator {
     JSGeneratorState    state;
     JSStackFrame        frame;
+    JSArena             arena;
     jsval               stack[1];
 } JSGenerator;
 
@@ -719,9 +720,12 @@ js_NewGenerator(JSContext *cx, JSStackFrame *fp)
     gen->frame.script = fp->script;
     gen->frame.fun = fp->fun;
     gen->frame.thisp = fp->thisp;
+    gen->arena.next = NULL;
 
     /* Use newsp to carve space out of gen->stack. */
     newsp = gen->stack;
+    gen->arena.base = (jsuword) newsp;
+    gen->arena.limit = gen->arena.avail = (jsuword) (newsp + nslots);
 
 #define COPY_STACK_ARRAY(vec,cnt,num)                                         \
     JS_BEGIN_MACRO                                                            \
@@ -769,6 +773,7 @@ generator_send(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
     JSGenerator *gen;
     JSString *str;
     JSStackFrame *fp;
+    JSArena *arena;
     JSBool ok;
     jsval junk;
 
@@ -790,6 +795,8 @@ generator_send(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
     }
 
     fp = cx->fp;
+    arena = cx->stackPool.current;
+    cx->stackPool.current = &gen->arena;
     cx->fp = &gen->frame;
     gen->frame.down = fp;
 
@@ -797,6 +804,7 @@ generator_send(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
     gen->frame.sp[-1] = (argc != 0) ? argv[0] : JSVAL_VOID;
     ok = js_Interpret(cx, gen->frame.pc, &junk);
     cx->fp = fp;
+    cx->stackPool.current = arena;
 
     if (!ok) {
         if (cx->throwing)