[deoptimizer] Handle Generator object in-object properties.

This adds missing support for in-object properties within objects having
the {JSGeneratorObject} type to materialization during deoptimization.
For corner-cases where the implicit generator object is statically known
not to escape, object layout might still be arbitrarily complex.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-732169
BUG=chromium:732169,v8:6481

Change-Id: I32f373913d60af64981dc4ed66873cc8a1dbe872
Reviewed-on: https://chromium-review.googlesource.com/530230Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45870}

src/deoptimizer.cc

@@ -4464,6 +4464,12 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
       object->set_resume_mode(Smi::cast(*resume_mode)->value());
       object->set_continuation(Smi::cast(*continuation_offset)->value());
       object->set_register_file(FixedArray::cast(*register_file));
+      int in_object_properties = map->GetInObjectProperties();
+      for (int i = 0; i < in_object_properties; ++i) {
+        Handle<Object> value = materializer.FieldAt(value_index);
+        FieldIndex index = FieldIndex::ForPropertyIndex(object->map(), i);
+        object->FastPropertyAtPut(index, *value);
+      }
       return object;
     }
     case CONS_STRING_TYPE: {

test/mjsunit/regress/regress-crbug-732169.js

@@ -4,11 +4,26 @@
 
 // Flags: --allow-natives-syntax
 
-function* f([x]) { yield x }
-// No warm-up of {f} to trigger soft deopt.
-%OptimizeFunctionOnNextCall(f);
-var gen = f([23]);
+(function TestGeneratorMaterialization() {
+  function* f([x]) { yield x }
+  // No warm-up of {f} to trigger soft deopt.
+  %OptimizeFunctionOnNextCall(f);
+  var gen = f([23]);
+  assertEquals("[object Generator]", gen.toString());
+  assertEquals({ done:false, value:23 }, gen.next());
+  assertEquals({ done:true, value:undefined }, gen.next());
+})();
 
-assertEquals("[object Generator]", gen.toString());
-assertEquals({ done:false, value:23 }, gen.next());
-assertEquals({ done:true, value:undefined }, gen.next());
+(function TestGeneratorMaterializationWithProperties() {
+  function* f(x = (%_DeoptimizeNow(), 23)) { yield x }
+  function g() {
+    var gen = f();
+    gen.p = 42;
+    return gen;
+  }
+  function h() { f() }
+  // Enough warm-up to make {p} an in-object property.
+  for (var i = 0; i < 100; ++i) { g(); h(); }
+  %OptimizeFunctionOnNextCall(h);
+  h();  // In {h} the generator does not escape.
+})();