Merging upstream version 125.0.3.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

3 files changed, 32 insertions, 0 deletions

diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 5cb47f2425..cd586ad2a7 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -10949,6 +10949,12 @@ GeneralParser<ParseHandler, Unit>::memberPropertyAccess(
   if (handler_.isArgumentsName(lhs) && handler_.isLengthName(name)) {
     MOZ_ASSERT(pc_->numberOfArgumentsNames > 0);
     pc_->numberOfArgumentsNames--;
+    // Currently when resuming Generators don't get their argument length set
+    // in the interpreter frame (see InterpreterStack::resumeGeneratorCallFrame,
+    // and its call to initCallFrame).
+    if (pc_->isGeneratorOrAsync()) {
+      pc_->sc()->setIneligibleForArgumentsLength();
+    }
     return handler_.newArgumentsLength(lhs, name);
   }
 
diff --git a/js/src/jit-test/tests/arguments/bug1892699-1.js b/js/src/jit-test/tests/arguments/bug1892699-1.js
new file mode 100644
index 0000000000..9804f26a13
--- /dev/null
+++ b/js/src/jit-test/tests/arguments/bug1892699-1.js
@@ -0,0 +1,10 @@
+function* a(x, y, z) {
+    if (arguments.length !== 3) {
+        throw "Wrong output";
+    }
+    yield x;
+    yield y;
+    yield z;
+}
+const x = a(3, 4, 5);
+x.next();
diff --git a/js/src/jit-test/tests/arguments/bug1892699.js b/js/src/jit-test/tests/arguments/bug1892699.js
new file mode 100644
index 0000000000..d01ab67b1e
--- /dev/null
+++ b/js/src/jit-test/tests/arguments/bug1892699.js
@@ -0,0 +1,16 @@
+async function a(x, y, z) {
+    if (arguments.length !== 3) {
+        throw "Wrong output";
+    }
+    await x;
+    if (arguments.length !== 3) {
+        throw "Wrong output";
+    }
+    await y;
+    if (arguments.length !== 3) {
+        throw "Wrong output";
+    }
+    await z;
+}
+const p = a(3, 4, 5);
+p.then(() => { assertEq(true, true) })