Bug 528644: do not generate JSOP_GETUPVAR in a generator called from eval, r=mrbkap

js/src/jsemit.cpp

@@ -2098,6 +2098,14 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             if (op != JSOP_NAME)
                 return JS_TRUE;
 
+            /*
+             * Generator functions may be resumed from any call stack, which
+             * defeats the display optimization to static link searching used
+             * by JSOP_{GET,CALL}UPVAR.
+             */
+            if (cg->flags & TCF_FUN_IS_GENERATOR)
+                return JS_TRUE;
+
             return MakeUpvarForEval(pn, cg);
         }
         return JS_TRUE;

js/src/trace-test/tests/basic/bug528644.js

@@ -0,0 +1,16 @@
+// Don't crash
+
+function g(foo) {
+  for (a in foo) {
+  }
+}
+
+var makegen = eval("\n\
+  function(b) {\n\
+      var h = \n\
+        eval(\"new function() { yield print(b) }\" ); \n\
+    return h\n\
+  }\n\
+");
+
+g(makegen());