Fix stack frame reconstruction for generators with formal arguments

The formal parameter count was always being treated as an untagged
integer, but it is actually a Smi on ia32 and arm.

R=mstarzinger@chromium.org
BUG=v8:2355
TEST=mjsunit/harmony/generators-iteration

Review URL: https://codereview.chromium.org/17485002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/arm/full-codegen-arm.cc

@@ -2132,7 +2132,7 @@ void FullCodeGenerator::EmitGeneratorResume(Expression *generator,
   __ LoadRoot(r2, Heap::kTheHoleValueRootIndex);
   Label push_argument_holes, push_frame;
   __ bind(&push_argument_holes);
-  __ sub(r3, r3, Operand(1), SetCC);
+  __ sub(r3, r3, Operand(Smi::FromInt(1)), SetCC);
   __ b(mi, &push_frame);
   __ push(r2);
   __ jmp(&push_argument_holes);

src/ia32/full-codegen-ia32.cc

@@ -2091,7 +2091,7 @@ void FullCodeGenerator::EmitGeneratorResume(Expression *generator,
   __ mov(ecx, isolate()->factory()->the_hole_value());
   Label push_argument_holes, push_frame;
   __ bind(&push_argument_holes);
-  __ sub(edx, Immediate(1));
+  __ sub(edx, Immediate(Smi::FromInt(1)));
   __ j(carry, &push_frame);
   __ push(ecx);
   __ jmp(&push_argument_holes);

test/mjsunit/harmony/generators-iteration.js

@@ -346,6 +346,15 @@ TestGenerator(
     "foo",
     [3, undefined]);
 
+// Access to this with formal arguments.
+TestGenerator(
+    function () {
+      return ({ x: 42, g: function* (a) { yield this.x } }).g(0);
+    },
+    [42, undefined],
+    "foo",
+    [42, undefined]);
+
 // Test that yield* re-yields received results without re-boxing.
 function TestDelegatingYield() {
   function results(results) {