[Epic]: Fix jitting of generator functions

[ShortDevelopment]

Related issues

• Segmentation fault in NativeCodeGenerator::CheckCodeGen #6965
• Assertion error: bad type object in conversion ToInteger #6964
• Segmentation fault in Js::RecyclableObject::GetType #6963
• Invalid memory access in GetEntryPoint #6691
• Invalid Memory Access in GetScriptContext #6704

Progress so far

• Rework how captured values are written to GeneratorBailInInstrs #6293
• Generator misc #6533
• Enable Jit for Generators, Asyncs and Async Generators #6662
• Handle corrupted generator or async generator prototype #6684
• Fix Errors in Generator Jit for SlotArray and CopyProp Restores #6700
• Disable OpHelperReg optimisation for Coroutines #6706

---

@rhuanjl @ppenzin Feel free to edit this message

[rhuanjl]

I actually think all those open issues/bugs are hitting the same underlying error but doing different things after hence not all the same crash message.

I've added a testcase for what (I think is) the underlying issue of all those in #6990 as well as disabling Generator Function Jit BUT enabling the safer Generator Loop Body Jit.

[rhuanjl]

I haven't gone through them all but I think there are 30+ issues open that relate to this. Many of them are dups but it's hard to confirm how many.

IF we disable generator JIT and enable the simpler loop-body-jit not sure what to do with all these issues whether to close them or keep them for ref if we ever re-visit generator JIT - my loop-body-jit PR includes a test case that I think captures the issue behind 5+ of the relevant issues but not sure about all of them.

[ppenzin]

A scenario to entertain: adding reproducers for these issues to the suite and close them if they pass with current loop-only JITing, then we will have a set of tests to clear when we reenable full function JITing.

[rhuanjl]

A scenario to entertain: adding reproducers for these issues to the suite and close them if they pass with current loop-only JITing, then we will have a set of tests to clear when we reenable full function JITing.

I added a reduced test case for one point that I think underpins a lot of the issues here: https://github.com/chakra-core/ChakraCore/blob/master/test/es6GeneratorJit/newtest.js

I didn't want to multiply equivalent cases; though it's hard to always work out exactly what is causing the issue.