diff --git a/js/src/debugger/Debugger.cpp b/js/src/debugger/Debugger.cpp index 042454c94466..d1607366a8b9 100644 --- a/js/src/debugger/Debugger.cpp +++ b/js/src/debugger/Debugger.cpp @@ -2571,6 +2571,12 @@ bool DebugAPI::onSingleStep(JSContext* cx) { continue; } + // A closed generator no longer has a callee so it will not be able to + // compare with the trappingScript. + if (genObj.isClosed()) { + continue; + } + // If a frame isn't live, but it has an entry in generatorFrames, // it had better be suspended. MOZ_ASSERT(genObj.isSuspended()); diff --git a/js/src/jit-test/tests/debug/bug1647309.js b/js/src/jit-test/tests/debug/bug1647309.js new file mode 100644 index 000000000000..e4ffcfc349f5 --- /dev/null +++ b/js/src/jit-test/tests/debug/bug1647309.js @@ -0,0 +1,18 @@ +// |jit-test| skip-if: !('oomTest' in this) + +const g = newGlobal({ newCompartment: true }); +const dbg = new Debugger(g); + +// Define async generator in debuggee compartment. +g.eval("async function* f() { }"); + +// Use onEnterFrame hook to create generatorFrames entry. +dbg.onEnterFrame = () => {}; + +// Trigger failure in AsyncGeneratorNext. +ignoreUnhandledRejections(); +oomTest(function() { g.f().next(); }); + +// Trigger DebugAPI::onSingleStep to check generatorFrames. +dbg.onDebuggerStatement = frame => { frame.onStep = () => {}; } +g.eval("debugger");