Reviewers: mvstanton,
Description:
Handle exception when retrieving toJSON function in JSON.stringify.
[email protected]
BUG=349335
Please review this at https://codereview.chromium.org/187603002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+4, -6 lines):
M src/json-stringifier.h
A + test/mjsunit/regress/regress-349335.js
Index: src/json-stringifier.h
diff --git a/src/json-stringifier.h b/src/json-stringifier.h
index
0d17b356abb0a1ac1a8447954db81f1386483083..4510c4b45b65b9b8c18079a46e901d69eb4a355f
100644
--- a/src/json-stringifier.h
+++ b/src/json-stringifier.h
@@ -360,6 +360,7 @@ Handle<Object>
BasicJsonStringifier::ApplyToJsonFunction(
PropertyAttributes attr;
Handle<Object> fun =
Object::GetProperty(object, object, &lookup, tojson_string_, &attr);
+ if (fun.is_null()) return Handle<Object>::null();
if (!fun->IsJSFunction()) return object;
// Call toJSON function.
Index: test/mjsunit/regress/regress-349335.js
diff --git a/test/mjsunit/regress/regress-347912.js
b/test/mjsunit/regress/regress-349335.js
similarity index 62%
copy from test/mjsunit/regress/regress-347912.js
copy to test/mjsunit/regress/regress-349335.js
index
b609e36c3d4981219abcd1c244ab46f849b2863b..0791171c7920255fdfc09ec25fb1b0b666e8d7e2
100644
--- a/test/mjsunit/regress/regress-347912.js
+++ b/test/mjsunit/regress/regress-349335.js
@@ -2,9 +2,6 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --allow-natives-syntax
-
-var __v_4 = {};
-__v_2 = {};
-__v_2[1024] = 0;
-%DebugPrint(__v_4);
+assertThrows(function() {
+ JSON.stringify({ get toJSON() { throw "error"; } });
+});
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
