Bug 1647309 - Account for closed generators in debugger stepperCount assert. r=loganfsmyth

Errors during async generator operations can close the generator but leave
entries in the Debugger::generatorFrames map. This trips up asserts in the
single-step code. Since a closed generator will not match the targettedScript
we simply ignore such entries while checking the assert.

Differential Revision: https://phabricator.services.mozilla.com/D81552

js/src/debugger/Debugger.cpp

@@ -2571,6 +2571,12 @@ bool DebugAPI::onSingleStep(JSContext* cx) {
           continue;
         }
 
+        // A closed generator no longer has a callee so it will not be able to
+        // compare with the trappingScript.
+        if (genObj.isClosed()) {
+          continue;
+        }
+
         // If a frame isn't live, but it has an entry in generatorFrames,
         // it had better be suspended.
         MOZ_ASSERT(genObj.isSuspended());

js/src/jit-test/tests/debug/bug1647309.js

@@ -0,0 +1,18 @@
+// |jit-test| skip-if: !('oomTest' in this)
+
+const g = newGlobal({ newCompartment: true });
+const dbg = new Debugger(g);
+
+// Define async generator in debuggee compartment.
+g.eval("async function* f() { }");
+
+// Use onEnterFrame hook to create generatorFrames entry.
+dbg.onEnterFrame = () => {};
+
+// Trigger failure in AsyncGeneratorNext.
+ignoreUnhandledRejections();
+oomTest(function() { g.f().next(); });
+
+// Trigger DebugAPI::onSingleStep to check generatorFrames.
+dbg.onDebuggerStatement = frame => { frame.onStep = () => {}; }
+g.eval("debugger");