Bug 1368736 - Mark BaselineFrame as debuggee frame in HandleDebugTrap if the breakpoint is on JSOP_DEBUGAFTERYIELD. r=shu

js/src/jit-test/tests/debug/bug1368736.js

@@ -0,0 +1,18 @@
+g = newGlobal();
+hits = 0;
+Debugger(g).onDebuggerStatement = function(frame) {
+    // Set a breakpoint at the JSOP_DEBUGAFTERYIELD op.
+    frame.script.setBreakpoint(71, {hit: function() { hits++; }});
+}
+g.eval(`
+function* range() {
+    debugger;
+    for (var i = 0; i < 3; i++) {
+        yield i;
+    }
+}
+var iter = range();
+for (var i = 0; i < 3; i++)
+    assertEq(iter.next().value, i);
+`);
+assertEq(hits, 2);

js/src/jit/VMFunctions.cpp

@@ -1060,6 +1060,14 @@ HandleDebugTrap(JSContext* cx, BaselineFrame* frame, uint8_t* retAddr, bool* mus
     RootedScript script(cx, frame->script());
     jsbytecode* pc = script->baselineScript()->icEntryFromReturnAddress(retAddr).pc(script);
 
+    if (*pc == JSOP_DEBUGAFTERYIELD) {
+        // JSOP_DEBUGAFTERYIELD will set the frame's debuggee flag, but if we
+        // set a breakpoint there we have to do it now.
+        MOZ_ASSERT(!frame->isDebuggee());
+        if (!DebugAfterYield(cx, frame))
+            return false;
+    }
+
     MOZ_ASSERT(frame->isDebuggee());
     MOZ_ASSERT(script->stepModeEnabled() || script->hasBreakpointsAt(pc));