Stack underflow in generator function

[bptato]

$ cat test.js
function* a() {
  for (var x of yield y)
    ;
}
$ node test.js
$ qjs test.js
InternalError: stack underflow (op=111, pc=9)

FWIW, bellard/quickjs exhibits the same behavior.

[bnoordhuis]

Parse error, most likely, and probably not super difficult to fix, but I'm curious: what is the expected result of a().next()?

It's my understanding that even when y is defined and yields e.g. an array, the spec still only allows throwing an exception because the expression yield y is an intermediate value that isn't itself iterable.

[bptato]

what is the expected result of a().next()?

I'm curious as well :P it's a reduced test case from a web app.
Node seems to first yield y, and only throws on the second next().

[saghul]

Node seems to first yield y, and only throws on the second next().

Really? Node, Deno and Bun all work for me. I guess because we are not calling a so it's just parsing?

[bnoordhuis]

Yes. It's not an early parse error, just a nonsensical construct, AFAICT.

[bnoordhuis]

BTW, I figured out the cause (unfortunate intermingling of yield + if_false vs. nip_catch), just need to think of an elegant way to fix it.

js_parse_assign_expr2 emits the yield + if_false, and calls emit_return (emits the nip_catch) in between.

[bptato]

Yes. It's not an early parse error, just a nonsensical construct, AFAICT.

Context: I was trying to load bluesky with my browser, and QJS output a stack underflow. I bisected the JS, and found the offending code segment (inside a generator function):

if (null != l && l.pages)
  for (var c of null == l ? void 0 : l.pages)
    for (var d of (c.list.creator.did === t && (yield c.list.creator), c.items))
      d.subject.did === t && (yield d.subject)

which I believe maps to this.
So originally it's just a transpiler collapsing an if such that yield happens to end up inside the expression (?) that evaluates to an iterable. I guess a more faithful test case is:

function* a() {
  for (var x of (yield {}, []))
    ;
}
var z = a();
z.next();
z.next();