Revision: 19670
Author: [email protected]
Date: Wed Mar 5 10:54:35 2014 UTC
Log: Handle exception when retrieving toJSON function in
JSON.stringify.
[email protected]
BUG=349335
LOG=N
Review URL: https://codereview.chromium.org/187603002
http://code.google.com/p/v8/source/detail?r=19670
Modified:
/branches/bleeding_edge/src/json-stringifier.h
/branches/bleeding_edge/test/mjsunit/json2.js
=======================================
--- /branches/bleeding_edge/src/json-stringifier.h Mon Sep 9 16:15:40 2013
UTC
+++ /branches/bleeding_edge/src/json-stringifier.h Wed Mar 5 10:54:35 2014
UTC
@@ -360,6 +360,7 @@
PropertyAttributes attr;
Handle<Object> fun =
Object::GetProperty(object, object, &lookup, tojson_string_, &attr);
+ if (fun.is_null()) return Handle<Object>::null();
if (!fun->IsJSFunction()) return object;
// Call toJSON function.
=======================================
--- /branches/bleeding_edge/test/mjsunit/json2.js Tue Nov 26 11:32:39 2013
UTC
+++ /branches/bleeding_edge/test/mjsunit/json2.js Wed Mar 5 10:54:35 2014
UTC
@@ -105,6 +105,10 @@
a: 1 };
TestStringify('321', tojson_via_getter);
+assertThrows(function() {
+ JSON.stringify({ get toJSON() { throw "error"; } });
+});
+
// Test toJSON with key.
tojson_obj = { toJSON: function(key) { return key + key; } };
var tojson_with_key_1 = { a: tojson_obj, b: tojson_obj };
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
