Seeing this when running jit-tests with my Baseline Interpreter patch stack, but it also affects Baseline. Run the tests below with --baseline-eager:

let g = newGlobal({newCompartment: true});
g.eval('function* f() { yield 1; yield 2; }');
let dbg = Debugger(g);
let genObj = null;
dbg.onEnterFrame = frame => {
    frame.onStep = function() {};
    if (genObj !== null) {
        dbg.removeDebuggee(g);
        dbg.addDebuggee(g);
    }
};
genObj = g.f();
for (let x of genObj) {}

Assertion failure: script->stepModeEnabled() || script->hasBreakpointsAt(pc), at jit/VMFunctions.cpp:1145

let g = newGlobal({newCompartment: true});
g.eval('function* f() { yield 1; yield 2; }');
let dbg = Debugger(g);
let genObj = null;
dbg.onEnterFrame = frame => {
    frame.onStep = function() {};
    if (genObj !== null) {
        dbg.removeDebuggee(g);
    }
};
genObj = g.f();
for (let x of genObj) {}

Assertion failure: frame->isDebuggee(), at jit/VMFunctions.cpp:1137

HandleDebugTrap calls DebugAfterYield, which can call the onEnterFrame debugger hook.
This hook can mess with debugger state so HandleDebugTrap needs to be a bit more
careful with its assertions.

https://hg.mozilla.org/mozilla-central/rev/42c0603e8464