Repository navigation
[Epic]: Fix jitting of generator functions #6988
Description
Related issues
- Segmentation fault in NativeCodeGenerator::CheckCodeGen #6965
- Assertion error: bad type object in conversion ToInteger #6964
- Segmentation fault in Js::RecyclableObject::GetType #6963
- Invalid memory access in
GetEntryPoint#6691 - Invalid Memory Access in
GetScriptContext#6704
Progress so far
- Rework how captured values are written to GeneratorBailInInstrs #6293
- Generator misc #6533
- Enable Jit for Generators, Asyncs and Async Generators #6662
- Handle corrupted generator or async generator prototype #6684
- Fix Errors in Generator Jit for SlotArray and CopyProp Restores #6700
- Disable OpHelperReg optimisation for Coroutines #6706
Activity
rhuanjl commentedon May 2, 2024
I actually think all those open issues/bugs are hitting the same underlying error but doing different things after hence not all the same crash message.
I've added a testcase for what (I think is) the underlying issue of all those in #6990 as well as disabling Generator Function Jit BUT enabling the safer Generator Loop Body Jit.
rhuanjl commentedon May 3, 2024
I haven't gone through them all but I think there are 30+ issues open that relate to this. Many of them are dups but it's hard to confirm how many.
IF we disable generator JIT and enable the simpler loop-body-jit not sure what to do with all these issues whether to close them or keep them for ref if we ever re-visit generator JIT - my loop-body-jit PR includes a test case that I think captures the issue behind 5+ of the relevant issues but not sure about all of them.
ppenzin commentedon May 28, 2024
A scenario to entertain: adding reproducers for these issues to the suite and close them if they pass with current loop-only JITing, then we will have a set of tests to clear when we reenable full function JITing.
rhuanjl commentedon May 30, 2024
I added a reduced test case for one point that I think underpins a lot of the issues here: https://github.com/chakra-core/ChakraCore/blob/master/test/es6GeneratorJit/newtest.js
I didn't want to multiply equivalent cases; though it's hard to always work out exactly what is causing the issue.