QML/JS: Reject yield expression not directly in generator functions

If an inner function contains a yield expression, we need to reject the
program even if that function is inside of a generator function.

Fixes: QTBUG-98356
Pick-to: 6.2 5.15
Change-Id: I2e820a1ca5f0da4080e313fd9809aa8bfdc1b681
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>

1 files changed, 14 insertions, 0 deletions

diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
index 0e3988e01f..cef3650c15 100644
--- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
+++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
@@ -252,6 +252,7 @@ private slots:
     void topLevelGeneratorFunction();
     void generatorCrashNewProperty();
     void generatorCallsGC();
+    void noYieldInInnerFunction();
     void qtbug_10696();
     void qtbug_11606();
     void qtbug_11600();
@@ -6559,6 +6560,19 @@ void tst_qqmlecmascript::generatorCallsGC()
     QVERIFY2(o != nullptr, qPrintable(component.errorString()));
 }
 
+void tst_qqmlecmascript::noYieldInInnerFunction()
+{
+    QJSEngine engine;
+    const QString program = R"(
+    function *a() {
+        (function() { yield 1; })();
+    };
+    )";
+    auto result = engine.evaluate(program);
+    QVERIFY(result.isError());
+    QCOMPARE(result.errorType(), QJSValue::SyntaxError);
+}
+
 // Test the "Qt.include" method
 void tst_qqmlecmascript::include()
 {