958950 - IteratorResult object for completed generators not from same global as next()

Status: REOPENED

(Core :: JavaScript Engine, defect)

Description

[André Bargull [:anba]]

When "25.3.3.1 GeneratorStart" creates the IteratorResult object, the generator's execution context was already removed from the execution context stack, that means that the CreateIterResultObject() call in 25.3.3.1, step 4g creates an object from the current running execution context. And that current running execution context is the execution context from the Generator.prototype.next() function. So the created IteratorResult object is from the same global/realm as the Generator.prototype.next() function. 

Note: IteratorResult objects created through `yield` are not the same global as the Generator.prototype.next() function, but instead from the same global as the generator function itself.

Test case:
---
js> o = newGlobal().eval("function*g(){ return 1 } g()")
js> next = function*(){}().next
js> next.call(o).constructor === Object

Expected: true
Actual: false
---

Comment 1

[Till Schneidereit [:till]]

CCing probably-interested parties

Comment 2

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.