QML/JS: Reject yield expression not directly in generator functions

If an inner function contains a yield expression, we need to reject the
program even if that function is inside of a generator function.

Fixes: QTBUG-98356
Pick-to: 6.2 5.15
Change-Id: I2e820a1ca5f0da4080e313fd9809aa8bfdc1b681
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>

1 files changed, 11 insertions, 0 deletions

diff --git a/src/qml/compiler/qv4codegen.cpp b/src/qml/compiler/qv4codegen.cpp
index 33b440e62c..fd55ce5562 100644
--- a/src/qml/compiler/qv4codegen.cpp
+++ b/src/qml/compiler/qv4codegen.cpp
@@ -3175,6 +3175,17 @@ bool Codegen::visit(YieldExpression *ast)
         return false;
     }
 
+    auto innerMostCurentFunctionContext = _context;
+    while (innerMostCurentFunctionContext && innerMostCurentFunctionContext->contextType != ContextType::Function)
+        innerMostCurentFunctionContext = innerMostCurentFunctionContext->parent;
+
+    Q_ASSERT(innerMostCurentFunctionContext); // yield outside function would have been rejected by parser
+
+    if (!innerMostCurentFunctionContext->isGenerator) {
+        throwSyntaxError(ast->firstSourceLocation(), u"Yield is only valid in generator functions"_qs);
+        return false;
+    }
+
     RegisterScope scope(this);
     TailCallBlocker blockTailCalls(this);
     Reference expr = ast->expression ? expression(ast->expression) : Reference::fromConst(this, Encode::undefined());