[maglev] GeneratorRestoreRegister can be the hole

victorgomes · V8 LUCI CQ · commit 0caaa4ea5677 · 2025-12-01T05:58:45.000-08:00
Fixed: 464965404 Change-Id: Iace45b1484358e2e9040ba454fb2aad2f6e6d49c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7210779 Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#104031}
diff --git a/src/maglev/maglev-ir.h b/src/maglev/maglev-ir.h
@@ -715,6 +715,7 @@ constexpr bool CanBeTheHoleValue(Opcode opcode) {
     // TODO(victorgomes): Should we have a list of builtins that could
     // return the hole?
     case Opcode::kCallBuiltin:
+    case Opcode::kGeneratorRestoreRegister:
     case Opcode::kRootConstant:
     case Opcode::kLoadContextSlot:
     case Opcode::kLoadContextSlotNoCells:
diff --git a/test/mjsunit/maglev/regress-464965404.js b/test/mjsunit/maglev/regress-464965404.js
@@ -0,0 +1,22 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function* foo(flag) {
+  if (flag) yield val;
+  let val = 1;
+}
+
+for (let i = 0; i < 500; ++i) {
+  for (let a of foo()) {}
+}
+
+function bar() {
+  for (let b of foo(true)) {
+    if (b) { assertUnreachable(); }
+  }
+}
+
+assertThrows(() => bar());
