Skip to content

Commit 7cafb32

Browse files
abatishchevabatishchev
authored
Merge branch 'master' into patch-1
2 parents 9caa530 + 8917a7e commit 7cafb32

File tree

8 files changed

+148
-8
lines changed

8 files changed

+148
-8
lines changed

‎lib/Backend/LinearScan.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5135,13 +5135,13 @@ void LinearScan::GeneratorBailIn::BuildBailInSymbolList(
51355135

51365136
if (unrestorableSymbols.TestAndClear(value->m_id))
51375137
{
5138-
if (this->NeedsReloadingSymWhenBailingIn(copyPropSym.Key()))
5138+
if (this->NeedsReloadingSymWhenBailingIn(copyPropSym.Value()))
51395139
{
51405140
BailInSymbol bailInSym(key->m_id /* fromByteCodeRegSlot */, value->m_id /* toBackendId */);
51415141
bailInSymbols->PrependNode(this->func->m_alloc, bailInSym);
51425142
}
51435143
}
5144-
else if (unrestorableSymbols.TestAndClear(key->m_id))
5144+
if (unrestorableSymbols.TestAndClear(key->m_id))
51455145
{
51465146
if (this->NeedsReloadingSymWhenBailingIn(copyPropSym.Key()))
51475147
{

‎lib/Runtime/ByteCode/ByteCodeEmitter.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1792,7 +1792,7 @@ void ByteCodeGenerator::FinalizeRegisters(FuncInfo* funcInfo, Js::FunctionBody*
17921792
}
17931793
}
17941794

1795-
// NOTE: The FB expects the yield reg to be the final non-temp.
1795+
// NOTE: The FunctionBody expects the yield reg to be the final non-temp.
17961796
if (byteCodeFunction->IsCoroutine())
17971797
{
17981798
if (funcInfo->root->IsAsync())

‎lib/Runtime/Language/JavascriptOperators.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7497,8 +7497,8 @@ using namespace Js;
74977497
DynamicType* newType = nullptr;
74987498
if (nonSimpleParamList)
74997499
{
7500-
bool skipLetAttrForArguments = ((JavascriptGeneratorFunction::IsBaseGeneratorFunction(funcCallee) || VarIs<JavascriptAsyncFunction>(funcCallee)) ?
7501-
VarTo<JavascriptGeneratorFunction>(funcCallee)->GetGeneratorVirtualScriptFunction()->GetFunctionBody()->HasReferenceableBuiltInArguments()
7500+
bool skipLetAttrForArguments = ( VarIs<JavascriptGeneratorFunction>(funcCallee) ?
7501+
UnsafeVarTo<JavascriptGeneratorFunction>(funcCallee)->GetGeneratorVirtualScriptFunction()->GetFunctionBody()->HasReferenceableBuiltInArguments()
75027502
: funcCallee->GetFunctionBody()->HasReferenceableBuiltInArguments());
75037503

75047504
if (skipLetAttrForArguments)

‎lib/Runtime/Library/JavascriptGenerator.cpp

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
//-------------------------------------------------------------------------------------------------------
22
// Copyright (C) Microsoft. All rights reserved.
3+
// Copyright (c) 2021 ChakraCore Project Contributors. All rights reserved.
34
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
45
//-------------------------------------------------------------------------------------------------------
56
#include "RuntimeLibraryPch.h"
@@ -171,6 +172,18 @@ Var JavascriptGenerator::CallGenerator(Var data, ResumeYieldKind resumeKind)
171172
JavascriptLibrary* library = scriptContext->GetLibrary();
172173
Var result = nullptr;
173174

175+
if (this->frame)
176+
{
177+
// if the function already has a state it may be going to resume in the jit
178+
// if so copy any innerScopes into registers jit can access
179+
uint32 innerScopeCount = this->scriptFunction->GetFunctionBody()->GetInnerScopeCount();
180+
for (uint32 i = 0; i < innerScopeCount; ++i)
181+
{
182+
Js::RegSlot reg = this->scriptFunction->GetFunctionBody()->GetFirstInnerScopeRegister() + i;
183+
this->frame->SetNonVarReg(reg, this->frame->InnerScopeFromIndex(i));
184+
}
185+
}
186+
174187
SetResumeYieldProperties(data, resumeKind);
175188

176189
{

‎test/es6/async-jit-bugs.js

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
//-------------------------------------------------------------------------------------------------------
2+
// Copyright (C) Microsoft. All rights reserved.
3+
// Copyright (c) 2021 ChakraCore Project Contributors. All rights reserved.
4+
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
5+
//-------------------------------------------------------------------------------------------------------
6+
7+
function main() {
8+
const v2 = [13.37,13.37,13.37,13.37,13.37];
9+
async function v4(v5,v6,v7,v8) {
10+
const v10 = 0;
11+
for (let v14 = 0; v14 < 8; v14++) {
12+
v5["vEBD7ei78q"] = v14;
13+
}
14+
for (let v16 = 1; v16 < 1337; v16++) {
15+
const v17 = v2.__proto__;
16+
const v23 = [13.37,13.37,-2.2250738585072014e-308,13.37,13.37];
17+
const v24 = v23.length;
18+
const v25 = "-4294967296";
19+
const v26 = 7;
20+
function* v28(v29,v30,v31,...v32) {}
21+
let v33 = -2.2250738585072014e-308;
22+
const v34 = v28(v33,Object,Object);
23+
const v35 = 13.37;
24+
const v36 = 2384357829;
25+
const v37 = await "-4294967296";
26+
const v38 = --v33;
27+
}
28+
const v39 = 128;
29+
print("pass")
30+
}
31+
v4("vEBD7ei78q");
32+
}
33+
main();

‎test/es6/generator-jit-bugs.js

Lines changed: 66 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,9 @@
44
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
55
//-------------------------------------------------------------------------------------------------------
66

7-
let results = 0;
8-
let test = 0;
7+
// Simpler mini-test harness to avoid any complicating factors when testing these jit bugs
8+
var results = 0;
9+
var test = 0;
910
const verbose = WScript.Arguments[0] != "summary";
1011

1112
function check(actual, expected) {
@@ -77,7 +78,7 @@ check(gen3.next().value, 1);
7778
check(gen3.next().value, 2);
7879

7980
// Test 4 - yield* iterator fails to be restored after Bail on No Profile
80-
title("Bail on no profile losing yield* iterator")
81+
title("Bail on no profile losing yield* iterator");
8182
function* gf4() {
8283
yield 0;
8384
yield* [1,2,3];
@@ -90,4 +91,66 @@ check(gen4.next().value, 1);
9091
check(gen4.next().value, 2);
9192
check(gen4.next().value, 3);
9293

94+
// Test 5 - scope slots fail to load inside for-in loop
95+
title("Load Scope Slots in presence of for-in");
96+
function* gf5(v1) {
97+
for(v0 in v1) {
98+
yield undefined;
99+
let v2 = {}
100+
function v3() { v2;}
101+
}
102+
}
103+
104+
const gen5 = gf5([0, 1]);
105+
106+
check(gen5.next().value, undefined);
107+
check(gen5.next().value, undefined);
108+
check(gen5.next().value, undefined);
109+
check(gen5.next().value, undefined);
110+
111+
// Test 6 - scope slots used in loop control have invalid values
112+
title("Load Scope Slots used in loop control");
113+
function* gf6 () {
114+
for (let v1 = 0; v1 < 1000; ++v1) {
115+
function foo() {v1;}
116+
yield v1;
117+
}
118+
}
119+
120+
const gen6 = gf6();
121+
122+
check(gen6.next().value, 0);
123+
check(gen6.next().value, 1);
124+
check(gen6.next().value, 2);
125+
check(gen6.next().value, 3);
126+
127+
// Test 7 - storing scoped slot from loop control in array
128+
title("Load Scope Slots used in loop control and captured indirectly");
129+
function* gf7(v1) {
130+
for (const v2 in v1) {
131+
yield v2;
132+
const v4 = [v2];
133+
function foo() { v4; }
134+
}
135+
}
136+
137+
const gen7 = gf7([0, 1, 2]);
138+
check(gen7.next().value, 0);
139+
check(gen7.next().value, 1);
140+
check(gen7.next().value, 2);
141+
check(gen7.next().value, undefined);
142+
143+
// Test 8 - copy prop'd sym is counted as two values - hits bookkeeping FailFast
144+
title("Copy prop sym double counted in unrestorable symbols hits FailFast");
145+
function* gf8() {
146+
var v8 = 1.1;
147+
yield* [];
148+
yield {v8};
149+
}
150+
151+
check(gf8().next().value.v8, 1.1);
152+
check(gf8().next().value.v8, 1.1);
153+
check(gf8().next().value.v8, 1.1);
154+
155+
93156
print("pass");

‎test/es6/rlexe.xml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,27 @@
153153
<tags>exclude_nonative, exclude_dynapogo</tags>
154154
</default>
155155
</test>
156+
<test>
157+
<default>
158+
<files>async-jit-bugs.js</files>
159+
<compile-flags>-JitES6Generators -args summary -endargs</compile-flags>
160+
<tags>exclude_nonative</tags>
161+
</default>
162+
</test>
163+
<test>
164+
<default>
165+
<files>async-jit-bugs.js</files>
166+
<compile-flags>-JitES6Generators -off:simplejit -args summary -endargs</compile-flags>
167+
<tags>exclude_nonative</tags>
168+
</default>
169+
</test>
170+
<test>
171+
<default>
172+
<files>async-jit-bugs.js</files>
173+
<compile-flags>-JitES6Generators -off:fulljit -args summary -endargs</compile-flags>
174+
<tags>exclude_nonative, exclude_dynapogo</tags>
175+
</default>
176+
</test>
156177
<test>
157178
<default>
158179
<files>proto_basic.js</files>

‎test/es7/async-generator-functionality.js

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
//-------------------------------------------------------------------------------------------------------
22
// Copyright (C) Microsoft. All rights reserved.
3+
// Copyright (c) 2021 ChakraCore Project Contributors. All rights reserved.
34
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
45
//-------------------------------------------------------------------------------------------------------
56

@@ -247,6 +248,15 @@ const tests = [
247248
ErrorPromise(this.name, ag.return.call(input), TypeError, `AsyncGenerator.prototype.return should reject with TypeError when called on ${typeof input} ${input}`);
248249
}
249250
}
251+
},
252+
{
253+
name : "AsyncGenerator with complex params containing eval",
254+
body() {
255+
async function* agf(param = 0) {
256+
eval('');
257+
}
258+
AddPromise(this.name, "Evaluate complex params and perform eval - but nothing to do should close", agf().next(), {done : true});
259+
}
250260
}
251261
];
252262

0 commit comments

Comments
 (0)