QML/JS: Reject yield expression not directly in generator functions

If an inner function contains a yield expression, we need to reject the
program even if that function is inside of a generator function.

Fixes: QTBUG-98356
Pick-to: 6.2 5.15
Change-Id: I2e820a1ca5f0da4080e313fd9809aa8bfdc1b681
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>

2 files changed, 25 insertions, 0 deletions

diff --git a/src/qml/compiler/qv4codegen.cpp b/src/qml/compiler/qv4codegen.cpp
index 33b440e62c..fd55ce5562 100644
--- a/src/qml/compiler/qv4codegen.cpp
+++ b/src/qml/compiler/qv4codegen.cpp
@@ -3175,6 +3175,17 @@ bool Codegen::visit(YieldExpression *ast)
         return false;
     }
 
+    auto innerMostCurentFunctionContext = _context;
+    while (innerMostCurentFunctionContext && innerMostCurentFunctionContext->contextType != ContextType::Function)
+        innerMostCurentFunctionContext = innerMostCurentFunctionContext->parent;
+
+    Q_ASSERT(innerMostCurentFunctionContext); // yield outside function would have been rejected by parser
+
+    if (!innerMostCurentFunctionContext->isGenerator) {
+        throwSyntaxError(ast->firstSourceLocation(), u"Yield is only valid in generator functions"_qs);
+        return false;
+    }
+
     RegisterScope scope(this);
     TailCallBlocker blockTailCalls(this);
     Reference expr = ast->expression ? expression(ast->expression) : Reference::fromConst(this, Encode::undefined());
diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
index 0e3988e01f..cef3650c15 100644
--- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
+++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
@@ -252,6 +252,7 @@ private slots:
     void topLevelGeneratorFunction();
     void generatorCrashNewProperty();
     void generatorCallsGC();
+    void noYieldInInnerFunction();
     void qtbug_10696();
     void qtbug_11606();
     void qtbug_11600();
@@ -6559,6 +6560,19 @@ void tst_qqmlecmascript::generatorCallsGC()
     QVERIFY2(o != nullptr, qPrintable(component.errorString()));
 }
 
+void tst_qqmlecmascript::noYieldInInnerFunction()
+{
+    QJSEngine engine;
+    const QString program = R"(
+    function *a() {
+        (function() { yield 1; })();
+    };
+    )";
+    auto result = engine.evaluate(program);
+    QVERIFY(result.isError());
+    QCOMPARE(result.errorType(), QJSValue::SyntaxError);
+}
+
 // Test the "Qt.include" method
 void tst_qqmlecmascript::include()
 {