Open bin2415 opened 3 years ago
Hmm - this is a different issue to the ScopeArray points I've been looking at - will investigate seperately.
Simplified repro:
{
let i = 0;
function* v1() {
function v7() {}
for (var v10 in []) {
yield undefined;
}
if(++i < 4)
v1().next()
v7 + 1;
}
}
v1().next();
Use flags -mic:1 -off:simplejit -bgjit-
Note - in the original repro code runs fine until stack overflow occurs - then after top function throws 2nd function down tries to execute to run to completion - error is seen in fulljitted code of the whole function.
Simplified repro triggers the continuation with a control variable instead of waiting for stack overflow - flags force the fulljit to occur sooner without needing 50+ iterations. (or 3000+ to get stack overflow)
Problem is to do with lifetime of the function v7
across a for...in loop containing a yield (or await if using an async function) that is never invoked - slightly obscure; but another one we need to fix if we're keeping generator jit on.
PoC:
Backtrace:
How to reproduce it:
Its backtrace is similar with #6690. I am not sure if their root cause are same.