Assertion failure in InlineCache.cpp

I discovered this while trying to produce a repro for #6160. The following code when run in ch hits an assertion in InlineCache.cpp:

WScript.Attach(() => {
    let iter = g();
    iter.next();
    iter.next();
});
(async () => {
    await 777;
    await 1206;
    WScript.Detach(() => {});
})();

function* g() { yield 0; }

The assertion that was hit is: https://github.com/microsoft/ChakraCore/blob/master/lib/Runtime/Language/InlineCache.cpp#L570

        Assert(!needsProtoInvalidation || isProtoRegistered);

[zenparsing]

@fatcerberus Yep, I already tried to repro this on my branch 🤞 but it’s there as well. It’s more about generators than anything else.

It sounds like #6160 might be the same thing (or at least closely related). I haven’t tried to dig into solutions yet but I hope to take a look sometime this week.

[fatcerberus]

Assuming debugging is enabled for a given session, JsDiagStartDebugging is called almost immediately after context creation, and runs continuously until the runtime is freed. This lets me run a debug server over loopback to allow attaching an ssj instance on-demand at any time.

I already made this commit in my own repo as a workaround - https://github.com/fatcerberus/minisphere/commit/71ccfc825017c7efb07262fa741fb9015d53b6fb

The only thing that concerned me with that workaround is that in my case, without it, CC hits a failfast (https://github.com/microsoft/ChakraCore/blob/master/lib/Runtime/Debug/DebugContext.cpp#L359) which struck me as a potential security issue I might just be sweeping under the carpet.