Fix and Enable Jitting Generators

[rhuanjl]

This PR incorporates the work done by @nhat-nguyen in #6245 and #6251 as well as a couple of fixes so it should work correctly and pass all tests:

1. Set ResumeYieldData after a bailout - not doing this caused a crash in AsyncGenerators
2. Fix the RemoveDummyYield and remove the flag for it - now it works it doesn't need a flag
3. Fix the Jitting of AsyncYieldIsReturn operation used as part of yield* within an AsyncGenerator
4. Under TTD disable jitting Async functions - jitting async functions works normally but fails under TTD
5. Disable on x86 - there was an x86 test error wasm/params.js (which uses a generator as part of its wasm test) it's an actual error with generators though, see longer comment below
6. Don't enable for AsyncGenerators as Yield* inside an asyncgenerator currently hits a failfast during jitting (possibly due to incorrect use/re-use of temporary registers), see longer comment below.

@zenparsing please could you take a look at this?

[rhuanjl]

EDIT: additional commit Allow for unusued replaced syms appears to fix this new issue - not certain I've got it right though so careful review needed

I've stumbled to another bug with this not covered by current tests and which I cannot currently fix - the following code snippet will hit a failfast in BuildBailInSymbolList. Disabling GlobOpt avoids this but obviously that is not desirable.

Notably if the FailFast is removed the code runs to completion safely - though I assume that the FailFast is there for a reason.

function* foo()
{
    const temp2 = undefined;
    while(true)
    {
        yield temp2;
    }
}

const gen = foo();
for (let i = 0; i < 2000; ++i)
{
    gen.next();
}

[rhuanjl]

I tried updating to latest and found that #6232 appears to have broken this - I will investigate and endeavour to fix but struggling to work out the cause of the breakage at the moment.

[zenparsing]

Thanks, @rhuanjl - I'll taking a look at it as well next week.

[rhuanjl]

So this looks safe to land, updated to latest and disabled AsyncGenerators, though could perhaps do with some further stress testing/fuzzing of some kind.

It enables jitting Generators and Async functions in x64 builds only.

I have two TODOs to go beyond this that I'd like help/advice with or someone else to pick up:

1. Enable on x86.
   The error encountered (and reason I'm leaving jitting generators on x86 disabled) is that GenerateFastInlineMathFround in a generator on x86 followed by a yield results in jitted code that segfaults. I cannot work out why.
   POC, in an x86 build with JitEs6Generators on and -mic:1 and -off:simplejit:

function* gf()
{
  while (true)
  {
    yield Math.fround(Math.PI);
  }
}

const gen = gf();

gen.next();
gen.next();
gen.next();
gen.next();

2. Enable for AsyncGenerators - worked for AsyncGenerators with my fixes above prior to Change the way the JIT renumbers byte code temps #6232 but not anymore.
   • Specifically yield* inside an AsyncGenerator will FailFast when being jitted
   • I think this is because EmitYieldStar uses and re-uses a lot of temp registers and it's not doing it right in light of Change the way the JIT renumbers byte code temps #6232
   • With the change to how they're handled I don't sufficiently understand how temps work to fix this.
   • Considering that AsyncGenerators are still completely disabled in release builds, this point is perhaps a lower priority

[rhuanjl]

Note: Test failure is "Agent lost communication with the server" and not an actual test failure. Assume there will be some further changes from forthcoming review so tests can be re-run then.

[zenparsing]

@rhuanjl Right, there's an issue with our Win7 test runner at the moment.

[rhuanjl]

I've dropped the Allow for unused replaced syms as that issue was fixed properly by #6293 I've also updated to latest.

As above this is still only enabling jitting for generators and async functions NOT async generators. AND it's still x64 only.

[zenparsing]

I'd like to take a look at the x86 issue before we merge this.

[rhuanjl]

I spent a bit of time trying to dig into the x86 issue but couldn't work out what the cause for it was the crash occurs in an x86 build only when at runtime the engine attempts to yield the return value of Math.fround that has been lowered with GenerateFastInlineMathFround - but that was as far as I could get.

[rhuanjl]

Closing as much of this is incompatible with #6312

[zenparsing]

@rhuanjl I just tried to repro the x86 issue using your POC on master and did not get a failure. Does it still repro for you?

[rhuanjl]

@rhuanjl I just tried to repro the x86 issue using your POC on master and did not get a failure. Does it still repro for you?

Just tested and it doesn't repro for me on master either. It must have been brought in by something else on this branch, possibly the OP_ResumeYield fast path or the removal of the dummy/startup yield.

[zenparsing]

It could also have been due to that bug we recently fixed. Thanks!