WebKit
diff --git a/‎JSTests/stress/async-iterator-completed-producer-no-double-drive.js‎
Lines changed: 101 additions & 0 deletions b/‎JSTests/stress/async-iterator-completed-producer-no-double-drive.js‎
Lines changed: 101 additions & 0 deletions
diff --git a/‎JSTests/stress/async-iterator-fast-consumer-manual-next-drive.js‎
Lines changed: 66 additions & 0 deletions b/‎JSTests/stress/async-iterator-fast-consumer-manual-next-drive.js‎
Lines changed: 66 additions & 0 deletions
diff --git a/‎JSTests/stress/async-iterator-fast-consumer-microtask-ticks.js‎
Lines changed: 101 additions & 0 deletions b/‎JSTests/stress/async-iterator-fast-consumer-microtask-ticks.js‎
Lines changed: 101 additions & 0 deletions
diff --git a/‎JSTests/stress/async-iterator-fast-consumer-reentrancy.js‎
Lines changed: 102 additions & 0 deletions b/‎JSTests/stress/async-iterator-fast-consumer-reentrancy.js‎
Lines changed: 102 additions & 0 deletions
@@ -0,0 +1,101 @@
+// Regression test for the completed-producer fast path in enqueueAsyncGeneratorFastConsumer
+// (runtime/JSMicrotask.cpp). When a `for await` consumes a genuine async generator that is ALREADY in
+// the Completed state, op_async_iterator_next's fast branch settles { value: undefined, done: true }
+// immediately AND schedules an AsyncGeneratorFastConsumerResume microtask for the consumer frame. That
+// completed branch must still set the consumer's SuppressFastResume flag; otherwise the consumer is
+// driven twice -- once by that microtask, once by the normal await-Promise machinery its own driver
+// (driveAsyncFunction / asyncFunctionGeneratorBodyCall / asyncGeneratorBodyCall) attaches when it
+// suspends at the following op_yield -- re-entering an already-resolving frame and double-advancing it.
+//
+// We exercise every driver: an async-function consumer's initial run (driveAsyncFunction) and its
+// subsequent resumes (asyncFunctionGeneratorBodyCall), plus an async-generator consumer
+// (asyncGeneratorBodyCall), each re-iterating an exhausted genuine async generator. Warmed hot enough
+// to reach the upper JIT tiers. With the bug, the stray extra resume inflates counters / sums, throws,
+// or hangs (main never completes); with the fix every count is exact.
+
+function assert(cond, message) {
+    if (!cond)
+        throw new Error("Assertion failed: " + message);
+}
+
+function makeGen() {
+    return (async function* () {
+        yield 1;
+        yield 2;
+    })();
+}
+
+// Counts how many times each consumer's post-loop tail actually executes. A double-drive would run a
+// tail more than once (or corrupt the frame), so these must exactly match the number of calls.
+let tailRuns = 0;
+
+// Async-function consumer. First loop exhausts g; second loop re-iterates the now-Completed g (body
+// must never run); then a real await forces a second suspension so any stray resume is observable.
+async function reconsume() {
+    const g = makeGen();
+    let sum = 0;
+    for await (const x of g)
+        sum += x;               // 1 + 2
+    for await (const x of g)
+        sum += 1000;            // g Completed -> must NOT run
+    await Promise.resolve();    // suspend again; a stray resume would double-advance past here
+    tailRuns++;
+    return sum;
+}
+
+// Async-function consumer whose very first suspension is the completed-producer next (initial-run path,
+// driven by driveAsyncFunction rather than asyncFunctionGeneratorBodyCall).
+async function consumeAlreadyExhausted(g) {
+    let count = 0;
+    for await (const x of g)
+        count += 1;             // g Completed -> must NOT run
+    tailRuns++;
+    return count;
+}
+
+// Async-generator consumer over a completed producer (asyncGeneratorBodyCall driver).
+async function* genConsumeExhausted(g) {
+    for await (const x of g)
+        yield x;                // g Completed -> must NOT yield
+    yield -1;                   // sentinel, must be produced exactly once
+    tailRuns++;
+}
+
+let done = false;
+let error = null;
+
+async function main() {
+    const N = testLoopCount;
+    let expectedTailRuns = 0;
+
+    for (let k = 0; k < N; k++) {
+        const r = await reconsume();
+        assert(r === 3, "reconsume expected 3, got " + r);
+        expectedTailRuns++;
+
+        const g = makeGen();
+        for await (const _ of g) { }               // exhaust
+        const c = await consumeAlreadyExhausted(g);
+        assert(c === 0, "consumeAlreadyExhausted expected 0, got " + c);
+        expectedTailRuns++;
+
+        const g2 = makeGen();
+        for await (const _ of g2) { }              // exhaust
+        const collected = [];
+        for await (const y of genConsumeExhausted(g2))
+            collected.push(y);
+        assert(collected.length === 1 && collected[0] === -1,
+            "genConsumeExhausted produced " + JSON.stringify(collected));
+        expectedTailRuns++;
+    }
+
+    assert(tailRuns === expectedTailRuns, "tailRuns expected " + expectedTailRuns + ", got " + tailRuns);
+}
+
+main().then(() => { done = true; }, (e) => { error = e; });
+
+drainMicrotasks();
+
+if (error)
+    throw error;
+assert(done, "async main() did not complete");
@@ -0,0 +1,66 @@
+// Regression test for the double-drive segfault fixed in asyncGeneratorSuspend (runtime/JSMicrotask.cpp).
+// An async generator that is itself a `for await` consumer of another async generator takes
+// op_async_iterator_next's fast-enqueue branch, which sets the consumer's SuppressFastResume flag and
+// arranges its resume via a JSSlimPromiseReaction on the producer. When such a consumer is driven
+// DIRECTLY by .next() (the inline AsyncGeneratorPrototype.next path -> asyncGeneratorSuspend host fn),
+// rather than by an outer for-await, asyncGeneratorSuspend must honor SuppressFastResume too; otherwise
+// the consumer is resumed twice (once by the producer's reaction, once by the normal await machinery),
+// corrupting the state machine and crashing. Every other driver already had this guard.
+
+function assert(cond, message) {
+    if (!cond)
+        throw new Error("Assertion failed: " + message);
+}
+
+function makeProducer() {
+    return (async function* () { yield 1; yield 2; yield 3; })();
+}
+
+// Async-generator consumer, driven below by manual .next() (not by a for-await).
+async function* makeConsumer(producer) {
+    let hits = 0;
+    for await (const x of producer) {
+        hits++;
+        yield x * 10 + hits;   // 11, 22, 33
+    }
+    yield 999;                 // sentinel: emitted exactly once, after the loop
+}
+
+// Manually drive an async generator to exhaustion via awaited .next() calls.
+async function driveToArray(gen) {
+    const out = [];
+    let r;
+    while (!(r = await gen.next()).done)
+        out.push(r.value);
+    return out;
+}
+
+let done = false;
+let error = null;
+
+async function main() {
+    const N = testLoopCount; // warm hot enough to reach the upper JIT tiers.
+    for (let k = 0; k < N; k++) {
+        const collected = await driveToArray(makeConsumer(makeProducer()));
+        assert(collected.length === 4, "expected 4 values, got " + collected.length);
+        assert(collected[0] === 11 && collected[1] === 22 && collected[2] === 33 && collected[3] === 999,
+            "unexpected values: " + collected.join(","));
+
+        // Also drive one where the consumer is closed early via .return() mid-stream.
+        const g = makeConsumer(makeProducer());
+        const first = await g.next();
+        assert(first.value === 11 && !first.done, "first: " + JSON.stringify(first));
+        const ret = await g.return("bye");
+        assert(ret.done === true && ret.value === "bye", "return: " + JSON.stringify(ret));
+        const after = await g.next();
+        assert(after.done === true && after.value === undefined, "after-return: " + JSON.stringify(after));
+    }
+}
+
+main().then(() => { done = true; }, (e) => { error = e; });
+
+drainMicrotasks();
+
+if (error)
+    throw error;
+assert(done, "async main() did not complete");
@@ -0,0 +1,101 @@
+// Verifies the for-await fast consumer consumes the EXACT number of microtask turns per step that the
+// spec (and V8/Node) require -- no more, no fewer. Each scenario launches a fixed 8-turn background
+// microtask "ruler" before the consumer; the interleaving of ruler ticks (Rn) with consumer/producer
+// events makes the per-step tick cadence observable. The expected sequences below were captured from
+// V8 (Node) and are the spec-correct ground truth; the fast consumer must reproduce them byte-for-byte.
+// A drifted tick count (e.g. an extra/missing await turn) reorders these and fails.
+
+function assert(cond, message) {
+    if (!cond)
+        throw new Error("Assertion failed: " + message);
+}
+
+async function scenario(body) {
+    const log = [];
+    const E = s => log.push(s);
+    let p = Promise.resolve();
+    for (let i = 0; i < 8; i++) {
+        const j = i;
+        p = p.then(() => E("R" + j));
+    }
+    await body(E);
+    return log.join(",");
+}
+
+const scenarios = {
+    async gen3(E) {
+        async function* g() { yield 1; yield 2; yield 3; }
+        for await (const x of g()) E("v" + x);
+        E("done");
+    },
+    async break(E) {
+        async function* g() { try { yield 1; yield 2; yield 3; } finally { E("fin"); } }
+        for await (const x of g()) { E("v" + x); if (x === 2) break; }
+        E("after");
+    },
+    async throw(E) {
+        async function* g() { try { yield 1; yield 2; } finally { E("fin"); } }
+        try { for await (const x of g()) { E("v" + x); if (x === 1) throw new Error("b"); } } catch (e) { E("caught"); }
+    },
+    async delegate(E) {
+        async function* inner() { yield "a"; yield "b"; }
+        async function* g() { yield 0; yield* inner(); yield 9; }
+        for await (const x of g()) E("v" + x);
+    },
+    async internalAwait(E) {
+        async function* g() { await 0; yield 1; await 0; yield 2; }
+        for await (const x of g()) E("v" + x);
+    },
+    async yieldPromise(E) {
+        async function* g() { yield Promise.resolve("p"); yield "q"; }
+        for await (const x of g()) E("v" + x);
+    },
+    async nested(E) {
+        async function* inner(k) { yield k + "a"; yield k + "b"; }
+        async function* outer() { yield 1; yield 2; }
+        for await (const o of outer()) for await (const i of inner(o)) E("v" + i);
+    },
+    async empty(E) {
+        async function* g() { }
+        for await (const x of g()) E("v" + x);
+        E("done");
+    },
+    async completedReconsume(E) {
+        async function* g() { yield 1; }
+        const it = g();
+        for await (const x of it) E("a" + x);
+        for await (const x of it) E("b" + x); // completed
+        E("done");
+    },
+};
+
+// Spec-correct interleavings (captured from V8 / Node).
+const expected = {
+    gen3: "R0,R1,v1,R2,R3,v2,R4,R5,v3,R6,done,R7",
+    break: "R0,R1,v1,R2,R3,v2,R4,fin,R5,after,R6",
+    throw: "R0,R1,v1,R2,fin,R3,caught,R4",
+    delegate: "R0,R1,v0,R2,R3,R4,va,R5,R6,R7,vb,v9",
+    internalAwait: "R0,R1,R2,v1,R3,R4,R5,v2,R6,R7",
+    yieldPromise: "R0,R1,vp,R2,R3,vq,R4,R5",
+    nested: "R0,R1,R2,R3,v1a,R4,R5,v1b,R6,R7,v2a,v2b",
+    empty: "R0,done,R1",
+    completedReconsume: "R0,R1,a1,R2,R3,done,R4",
+};
+
+let done = false;
+let error = null;
+
+async function main() {
+    for (const name of Object.keys(expected)) {
+        const got = await scenario(scenarios[name]);
+        assert(got === expected[name], name + "\n  expected: " + expected[name] + "\n  got:      " + got);
+    }
+}
+
+main().then(() => { done = true; }, (e) => { error = e; });
+
+drainMicrotasks();
+
+if (error)
+    throw error;
+assert(done, "async main() did not complete");
@@ -0,0 +1,102 @@
+// Regression tests for the SuppressFastResume flag (JSAsyncGenerator / JSAsyncFunctionGenerator per-cell
+// bit) under recursion and re-entrancy. The flag is set on a for-await consumer just before it suspends
+// at op_yield, and consumed at that suspend, so it must survive: interleaved/queued .next() requests on a
+// fast consumer, nested fast for-await in one generator, a producer that re-enters the consumer's .next()
+// while the consumer is Executing (must enqueue, not double-drive), reconsuming a completed generator, and
+// a manual .next() racing the fast resume. Expected values are the spec-correct results (verified against
+// V8); a double-drive or a lost/stale flag would reorder or duplicate them. Warmed to reach the upper JIT
+// tiers so the DFG/FTL fast path is exercised too.
+
+function assert(cond, message) {
+    if (!cond)
+        throw new Error("Assertion failed: " + message);
+}
+
+// Four queued .next() requests on an async-generator that itself for-awaits a producer.
+async function interleavedNext() {
+    async function* prod() { yield 1; yield 2; yield 3; }
+    async function* cons(p) { for await (const x of p) yield x * 10; }
+    const c = cons(prod());
+    const r = await Promise.all([c.next(), c.next(), c.next(), c.next()]);
+    return r.map(v => v.value + "/" + v.done).join(" ");
+}
+
+// Nested fast for-await inside one consumer generator (each op_async_iterator_next sets the flag, each
+// following op_yield consumes it -- the inner and outer loops must not clobber each other's flag).
+async function nestedFast() {
+    async function* inner(k) { yield k + "a"; yield k + "b"; }
+    async function* outer(p) { for await (const x of p) for await (const y of inner(x)) yield y; }
+    async function* src() { yield 1; yield 2; }
+    let s = "";
+    for await (const v of outer(src()))
+        s += v + ",";
+    return s;
+}
+
+// The producer, resumed synchronously by the consumer's fast next, calls the consumer's own .next() while
+// the consumer is Executing. That must only enqueue (not re-enter/double-drive) the consumer.
+async function reentrantProducer() {
+    let cRef;
+    async function* prod() { cRef.next(); yield 1; cRef.next(); yield 2; }
+    async function* cons(p) { for await (const x of p) yield x * 100; }
+    cRef = cons(prod());
+    const collected = [];
+    for await (const v of cRef) {
+        collected.push(v);
+        if (collected.length >= 4)
+            break;
+    }
+    return collected.join(",");
+}
+
+// Re-consume the same consumer instance with a second loop after it has completed.
+async function reconsume() {
+    async function* prod() { yield 1; yield 2; }
+    async function* cons(p) { for await (const x of p) yield x; yield -1; }
+    const c = cons(prod());
+    let s = "";
+    for await (const v of c) s += "a" + v + ",";
+    for await (const v of c) s += "b" + v + ","; // completed -> yields nothing
+    return s;
+}
+
+// A manual .next() issued while the consumer is mid-await of the producer (races the fast resume).
+async function nextDuringAwait() {
+    async function* prod() { yield 10; yield 20; yield 30; }
+    async function* cons(p) { for await (const x of p) yield x; }
+    const c = cons(prod());
+    const a = await c.next();
+    const pending = c.next();
+    const b = await pending;
+    const rest = await c.next();
+    return [a, b, rest].map(v => v.value + "/" + v.done).join(" ");
+}
+
+const cases = [
+    [interleavedNext, "10/false 20/false 30/false undefined/true"],
+    [nestedFast, "1a,1b,2a,2b,"],
+    [reentrantProducer, "100"],
+    [reconsume, "a1,a2,a-1,"],
+    [nextDuringAwait, "10/false 20/false 30/false"],
+];
+
+let done = false;
+let error = null;
+
+async function main() {
+    const N = testLoopCount; // warm hot enough to reach the upper JIT tiers.
+    for (let i = 0; i < N; i++) {
+        for (const [fn, expected] of cases) {
+            const got = await fn();
+            assert(got === expected, fn.name + " iter " + i + ": expected [" + expected + "] got [" + got + "]");
+        }
+    }
+}
+
+main().then(() => { done = true; }, (e) => { error = e; });
+
+drainMicrotasks();
+
+if (error)
+    throw error;
+assert(done, "async main() did not complete");