[turbofan] Fix serialization of resumables

This is a quick fix for the recent bailout-on-uninitialized feature of
the serializer, which does not work with resumables. For now, simply
treat the ResumeGenerator bytecode as if it was an exception handler
entry point. I want to revisit this later because the proper fix might
be to teach the serializer about the SwitchOnGeneratorState bytecode.

Bug: chromium:966560, v8:7790
Change-Id: I48bc6ba7299faa29802159cc7c36f4629667b5d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630670Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61877}

src/compiler/serializer-for-background-compilation.cc

@@ -100,7 +100,7 @@ class SerializerForBackgroundCompilation::Environment : public ZoneObject {
     DCHECK(IsDead());
   }
 
-  void ReviveForHandlerCode() {
+  void Revive() {
     DCHECK(IsDead());
     environment_hints_.resize(environment_hints_size(), Hints(zone()));
     DCHECK(!IsDead());
@@ -418,8 +418,10 @@ void SerializerForBackgroundCompilation::TraverseBytecode() {
     MergeAfterJump(&iterator);
 
     if (environment()->IsDead()) {
-      if (handler_matcher.CurrentBytecodeIsExceptionHandlerStart()) {
-        environment()->ReviveForHandlerCode();
+      if (iterator.current_bytecode() ==
+              interpreter::Bytecode::kResumeGenerator ||
+          handler_matcher.CurrentBytecodeIsExceptionHandlerStart()) {
+        environment()->Revive();
       } else {
         continue;  // Skip this bytecode since TF won't generate code for it.
       }

test/mjsunit/compiler/regress-966560-1.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+async function __f_3() {
+  return await __f_4();
+}
+async function __f_4() {
+  await x.then();
+  throw new Error();
+}
+async function __f_5(f) {
+  try {
+    await f();
+  } catch (e) {
+  }
+}
+(async() => {; %OptimizeFunctionOnNextCall(__f_4); await __f_5(__f_3); })();

test/mjsunit/compiler/regress-966560-2.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function* get() {
+  for (let x of [1,2,3]) {
+    yield;
+    get = [];
+  }
+}
+%OptimizeFunctionOnNextCall(get);
+get();