Ensure registers are spilled pre-BailIn

lib/Backend/LinearScan.cpp

@@ -3339,7 +3339,7 @@ LinearScan::KillImplicitRegs(IR::Instr *instr)
         return;
     }
 
-    if (instr->m_opcode == Js::OpCode::Yield)
+    if (instr->m_opcode == Js::OpCode::GeneratorBailInLabel)
     {
         this->bailIn.SpillRegsForBailIn();
         return;

test/es6/generator-jit-bugs.js

@@ -152,5 +152,22 @@ check(gf8().next().value.v8, 1.1);
 check(gf8().next().value.v8, 1.1);
 check(gf8().next().value.v8, 1.1);
 
+// Test 9 - double use of rax register when setting up BailIn
+title("Rax register must be spilled before BailIn")
+{
+    let i = 0;
+    function* v1() {
+        function v7() {}
+        for (var v10 in []) {
+            yield undefined;
+        }
+        if(++i < 4)
+            v1().next()
+        v7 + 1;
+    }
+}
+check(v1().next().value, undefined);
+
+
 
 print("pass");