1 files changed, 33 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/generators/yield-exception-stack-in-finally.js b/js/src/jit-test/tests/generators/yield-exception-stack-in-finally.js
new file mode 100644
index 0000000000..6a1a0ef006
--- /dev/null
+++ b/js/src/jit-test/tests/generators/yield-exception-stack-in-finally.js
@@ -0,0 +1,33 @@
+load(libdir + "asserts.js");
+
+var g = newGlobal({newCompartment: true})
+
+// Throw an exception from a different compartment.
+var thrower = g.Function(`
+  throw 0;
+`);
+
+function* throwAndYield() {
+  try {
+    thrower();
+  } finally {
+    // The |finally| block is entered with the exception stack on the function
+    // stack. The function stack is saved in the generator object when executing
+    // |yield|, so the exception stack, which was created in a different
+    // compartment, has to be wrapped into the current compartment.
+    yield;
+  }
+}
+assertThrowsValue(() => [...throwAndYield()], 0);
+
+function* throwAndNuke() {
+  try {
+    thrower();
+  } finally {
+    // The function stack contains the wrapped exception stack when entering
+    // the |finally| block. When nuking all CCWs it becomes a dead wrapper.
+    nukeAllCCWs();
+    yield;
+  }
+}
+assertThrowsValue(() => [...throwAndNuke()], 0);