Bug 1716931 - Bail out of CheckResumeKind r=iain

Differential Revision: https://phabricator.services.mozilla.com/D118538

js/src/jit-test/tests/warp/bug1716931.js

@@ -0,0 +1,13 @@
+// |jit-test| --fast-warmup; --no-threads
+
+function* foo(x) {
+    yield* x;
+    assertEq(true, false); // Unreachable
+}
+
+for (var i = 0; i < 10; i++) {
+    var count = 0;
+    for (var o of foo(Array(50))) {
+        if (count++ > 40) break;
+    }
+}

js/src/jit/WarpBuilder.cpp

@@ -2215,9 +2215,14 @@ bool WarpBuilder::build_ResumeKind(BytecodeLocation loc) {
 }
 
 bool WarpBuilder::build_CheckResumeKind(BytecodeLocation loc) {
-  // This comes after a yield, so from the perspective of -warp-
-  // this is unreachable code; we do want to manipulate the stack
-  // appropriately though.
+  // Outside of `yield*`, this is normally unreachable code in Warp,
+  // so we just manipulate the stack appropriately to ensure correct
+  // MIR generation.
+  //
+  // However, `yield*` emits a forced generator return which can be
+  // warp compiled, so in order to correctly handle these semantics
+  // we also generate a bailout, so that the forced generator return
+  // runs in baseline.
   MDefinition* resumeKind = current->pop();
   MDefinition* gen = current->pop();
   MDefinition* rval = current->peek(-1);
@@ -2227,6 +2232,11 @@ bool WarpBuilder::build_CheckResumeKind(BytecodeLocation loc) {
   gen->setImplicitlyUsedUnchecked();
   rval->setImplicitlyUsedUnchecked();
 
+  // Bail out if we encounter CheckResumeKind.
+  MBail* bail = MBail::New(alloc(), BailoutKind::Inevitable);
+  current->add(bail);
+  current->setAlwaysBails();
+
   return true;
 }