From 26e4f4cc1cb999295601feec7d2c094162bfac56 Mon Sep 17 00:00:00 2001
From: "yangguo@chromium.org"
 <yangguo@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Wed, 5 Mar 2014 10:54:35 +0000
Subject: [PATCH] Handle exception when retrieving toJSON function in
 JSON.stringify.

R=mvstanton@chromium.org
BUG=349335
LOG=N

Review URL: https://codereview.chromium.org/187603002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19670 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---
 src/json-stringifier.h | 1 +
 test/mjsunit/json2.js  | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/src/json-stringifier.h b/src/json-stringifier.h
index 0d17b35..4510c4b 100644
--- a/src/json-stringifier.h
+++ b/src/json-stringifier.h
@@ -360,6 +360,7 @@ Handle<Object> BasicJsonStringifier::ApplyToJsonFunction(
   PropertyAttributes attr;
   Handle<Object> fun =
       Object::GetProperty(object, object, &lookup, tojson_string_, &attr);
+  if (fun.is_null()) return Handle<Object>::null();
   if (!fun->IsJSFunction()) return object;
 
   // Call toJSON function.
diff --git a/test/mjsunit/json2.js b/test/mjsunit/json2.js
index 0894d77..f048f05 100644
--- a/test/mjsunit/json2.js
+++ b/test/mjsunit/json2.js
@@ -105,6 +105,10 @@ var tojson_via_getter = { get toJSON() {
                           a: 1 };
 TestStringify('321', tojson_via_getter);
 
+assertThrows(function() {
+  JSON.stringify({ get toJSON() { throw "error"; } });
+});
+
 // Test toJSON with key.
 tojson_obj = { toJSON: function(key) { return key + key; } };
 var tojson_with_key_1 = { a: tojson_obj, b: tojson_obj };
-- 
2.7.4