Fix stack frame reconstruction for generators with formal arguments

test/mjsunit/harmony/generators-iteration.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 328 matching lines @@
               [1, undefined],
               "foo",
               [1, undefined]);
 
 TestGenerator(
     function() { return GeneratorFunction('x', 'y', 'yield x + y;')(1, 2) },
     [3, undefined],
     "foo",
     [3, undefined]);
 
+// Access to this with formal arguments.
+TestGenerator(
+    function () {
+      return ({ x: 42, g: function* (a) { yield this.x } }).g(0);
+    },
+    [42, undefined],
+    "foo",
+    [42, undefined]);
+
 // Test that yield* re-yields received results without re-boxing.
 function TestDelegatingYield() {
   function results(results) {
     var i = 0;
     function next() {
       return results[i++];
     }
     return { next: next }
   }
   function* yield_results(expected) {
@@ skipping 272 matching lines @@
   function TestThrowRecursion() {
     function* g() { yield iter.throw(1); }
     var iter = g();
     return iter.next();
   }
   assertThrows(TestNextRecursion, Error);
   assertThrows(TestSendRecursion, Error);
   assertThrows(TestThrowRecursion, Error);
 }
 TestRecursion();