Async and generators: a suspended frame dereferences nothing the suspension produced (backport of #4088)

[lahma]

Backport of #4088 (bda631c87) to 4.x. The fix landed on main only; this is the same fix for the maintenance branch. Refs #4086.

What was wrong

await and yield suspend by returning a plain JsValue.Undefined, and the enclosing member link turns that into a sentinel Reference(undefined, undefined) — a placeholder for the shape of the answer, never a reference to read. Every consumer owes a context.IsSuspended() check before touching one. Nine did not, so they read undefined.undefined and raised a TypeError inside a frame that was already suspended.

AsyncBlockStart swallows that throw — the state is still SuspendedAwait — so it never reached the host and only its side effect survived: JintStatementList.LeavingOnException cleared the statement-list resume position on the way out, the resume replayed the body from statement 0, and every un-awaited side effect ran once more per suspension point. With a re-entrancy guard (if (inited) return;) the replay took the early return and silently truncated the rest of the body. A generator has nothing to swallow it, so the same shapes threw straight out of next().

Two shapes are wrong answers rather than duplicated side effects, and one never terminates:

shape	4.x before
(await p).x = 1	rejects the promise with a TypeError
o[await k] = 1	assigns to the literal key "undefined", never the real one
for await ((await p).a of it)	never terminates

?. is not the trigger, despite where the report put it: the guarded fast lane needs a literal property name, so every computed member read of an awaited or yielded value falls through to the unguarded one — (await p)[0] and (await p)[k] alike.

The fix

The missing context.IsSuspended() checks, added to JintMemberExpression.GetValue's fall-through lane, typeof, delete, ++/--, both assignment forms, the two object-pattern branches of ProcessPatterns and the non-destructuring for-in/for-of head; plus the exception filter no longer clears the resume position while the frame is suspended.

The per-site checks are the fix. The filter guard is only the net — a statement that throws never reaches the line that records its position, so keeping the position fixes nothing on its own for a shape that throws. It is kept because no shape was found where a kept position can mis-resume, and it stops any future sentinel leak replaying a body silently.

Adapted for 4.x

• The interpreter AGENTS.md gotcha and the docs/guide/migrating-to-v5.md section are dropped — neither file exists on this branch, and 4.x's root AGENTS.md is still the unsplit monolith.
• Tests transcribed from NUnit to xUnit, which is what 4.x's Jint.Tests still is. The attribute is the only difference; the assertions are AwesomeAssertions on both branches.
• Nothing else. All nine production sites have the same shape here — JintMemberExpression carries main's identical three-lane structure, only offset — so every hunk applied without conflict and was read back against its 4.x landing context rather than trusted to the merge.

Evidence on this branch

Jint.Tests/Runtime/SuspendedOptionalChainTests.cs (35 cases) run against the unfixed 4.x tree:

	net10.0	net472
before	28 failed, 6 passed of 34	28 failed, 6 passed of 34
after	35 / 35	35 / 35

The 35th case, AForAwaitOfHeadTargetingAMemberOfAnAwaitedValueRunsItsSideEffectsOnce, is excluded from the before counts because it does not fail — it hangs the runner, and the test host had to be killed by PID. That is the same 28-plus-one-hang split main measured before #4088. The six that pass unfixed are the …IsAControl cases, which bound the claim rather than evidence it.

Full 4.x solution, Release: Jint.Tests 7 162 (net10.0) / 7 077 (net472), Jint.Tests.PublicInterface 1 852 / 1 844, Jint.Tests.CommonScripts 28 / 28, Jint.Tests.SourceGenerators 52 — 0 failures anywhere.

test262: 102 499 passed, 183 skipped, 2 failed — and the same 2 failed / 102 499 passed / 183 skipped on the unfixed tree in a control run on this machine. Both are intl402/supportedLocalesOf-unicode-extensions-ignored.js (strict and sloppy) crossing the engine's 30 s timeout at 31 s under whole-suite CPU contention; run in isolation the file passes in 2 s on both trees. Pre-existing on this box, and nowhere near a suspension lane.

🤖 Generated with Claude Code