RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-10-31 10:22:45 +00:00
Code Issues Activity Actions

LibJS: Handle getter exception in JSONObject::serialize_json_property()

Browse source 
In the case of an exception in a property getter function we would not
return early, and a subsequent attempt to call the replacer function
would crash the interpreter due to call_internal() asserting.

Fixes #3548.
This commit is contained in:
Linus Groh 2020-09-19 12:57:31 +01:00 • committed by Andreas Kling
parent e1965a5a8e
commit c0e4353bde
2 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Libraries/LibJS/Runtime/JSONObject.cpp
View file

@ -150,6 +150,8 @@ JS_DEFINE_NATIVE_FUNCTION(JSONObject::stringify)
String JSONObject::serialize_json_property(Interpreter& interpreter, StringifyState& state, const PropertyName& key, Object* holder)
{
auto value = holder->get(key);
if (interpreter.exception())
return {};
if (value.is_object()) {
auto to_json = value.as_object().get("toJSON");
if (interpreter.exception())

10
Libraries/LibJS/Tests/builtins/JSON/JSON.stringify-exception-in-property-getter.js Normal file
View file

@ -0,0 +1,10 @@
test("Issue #3548, exception in property getter with replacer function", () => {
const o = {
get foo() {
throw Error();
},
};
expect(() => {
JSON.stringify(o, (_, value) => value);
}).toThrow(Error);
});