2 files changed, 51 insertions, 3 deletions

diff --git a/js/src/debugger/Object.cpp b/js/src/debugger/Object.cpp
index c5a4f1f6dc..17528b0fd9 100644
--- a/js/src/debugger/Object.cpp
+++ b/js/src/debugger/Object.cpp
@@ -209,6 +209,7 @@ struct MOZ_STACK_CLASS DebuggerObject::CallData {
   bool createSource();
   bool makeDebuggeeValueMethod();
   bool isSameNativeMethod();
+  bool isSameNativeWithJitInfoMethod();
   bool isNativeGetterWithJitInfo();
   bool unsafeDereferenceMethod();
   bool unwrapMethod();
@@ -1338,7 +1339,18 @@ bool DebuggerObject::CallData::isSameNativeMethod() {
     return false;
   }
 
-  return DebuggerObject::isSameNative(cx, object, args[0], args.rval());
+  return DebuggerObject::isSameNative(cx, object, args[0], CheckJitInfo::No,
+                                      args.rval());
+}
+
+bool DebuggerObject::CallData::isSameNativeWithJitInfoMethod() {
+  if (!args.requireAtLeast(
+          cx, "Debugger.Object.prototype.isSameNativeWithJitInfo", 1)) {
+    return false;
+  }
+
+  return DebuggerObject::isSameNative(cx, object, args[0], CheckJitInfo::Yes,
+                                      args.rval());
 }
 
 bool DebuggerObject::CallData::isNativeGetterWithJitInfo() {
@@ -1424,6 +1436,11 @@ struct DebuggerObject::PromiseReactionRecordBuilder
       // so we ignore it.
       return true;
     }
+    if (!unwrappedGenerator->realm()->isDebuggee()) {
+      // Caller can keep the reference to the debugger object even after
+      // removing the realm from debuggee.  Do nothing for this case.
+      return true;
+    }
     return dbg->getFrame(cx, unwrappedGenerator, &frame) && push(cx, frame);
   }
 
@@ -1535,6 +1552,7 @@ const JSFunctionSpec DebuggerObject::methods_[] = {
     JS_DEBUG_FN("createSource", createSource, 1),
     JS_DEBUG_FN("makeDebuggeeValue", makeDebuggeeValueMethod, 1),
     JS_DEBUG_FN("isSameNative", isSameNativeMethod, 1),
+    JS_DEBUG_FN("isSameNativeWithJitInfo", isSameNativeWithJitInfoMethod, 1),
     JS_DEBUG_FN("isNativeGetterWithJitInfo", isNativeGetterWithJitInfo, 1),
     JS_DEBUG_FN("unsafeDereference", unsafeDereferenceMethod, 0),
     JS_DEBUG_FN("unwrap", unwrapMethod, 0),
@@ -2576,9 +2594,36 @@ static JSAtom* MaybeGetSelfHostedFunctionName(const Value& v) {
   return GetClonedSelfHostedFunctionName(fun);
 }
 
+static bool IsSameNative(JSFunction* a, JSFunction* b,
+                         DebuggerObject::CheckJitInfo checkJitInfo) {
+  if (a->native() != b->native()) {
+    return false;
+  }
+
+  if (checkJitInfo == DebuggerObject::CheckJitInfo::No) {
+    return true;
+  }
+
+  // Both function should agree with the existence of JitInfo.
+
+  if (a->hasJitInfo() != b->hasJitInfo()) {
+    return false;
+  }
+
+  if (!a->hasJitInfo()) {
+    return true;
+  }
+
+  if (a->jitInfo() == b->jitInfo()) {
+    return true;
+  }
+
+  return false;
+}
+
 /* static */
 bool DebuggerObject::isSameNative(JSContext* cx, Handle<DebuggerObject*> object,
-                                  HandleValue value,
+                                  HandleValue value, CheckJitInfo checkJitInfo,
                                   MutableHandleValue result) {
   RootedValue referentValue(cx, ObjectValue(*object->referent()));
 
@@ -2602,7 +2647,8 @@ bool DebuggerObject::isSameNative(JSContext* cx, Handle<DebuggerObject*> object,
 
   RootedFunction referentFun(cx, EnsureNativeFunction(referentValue));
 
-  result.setBoolean(referentFun && referentFun->native() == fun->native());
+  result.setBoolean(referentFun &&
+                    IsSameNative(referentFun, fun, checkJitInfo));
   return true;
 }
 
diff --git a/js/src/debugger/Object.h b/js/src/debugger/Object.h
index 5141bd3133..15d2800e76 100644
--- a/js/src/debugger/Object.h
+++ b/js/src/debugger/Object.h
@@ -145,9 +145,11 @@ class DebuggerObject : public NativeObject {
                                               Handle<DebuggerObject*> object,
                                               HandleValue value,
                                               MutableHandleValue result);
+  enum class CheckJitInfo { No, Yes };
   [[nodiscard]] static bool isSameNative(JSContext* cx,
                                          Handle<DebuggerObject*> object,
                                          HandleValue value,
+                                         CheckJitInfo checkJitInfo,
                                          MutableHandleValue result);
   [[nodiscard]] static bool isNativeGetterWithJitInfo(
       JSContext* cx, Handle<DebuggerObject*> object, MutableHandleValue result);