Changeset 223731 in webkit for trunk/Source/JavaScriptCore/runtime/JSONObject.cpp

Timestamp:

Oct 19, 2017, 5:47:04 PM (8 years ago)

Author:

[email protected]

Message:

Stringifier::appendStringifiedValue() is missing an exception check.
​https://bugs.webkit.org/show_bug.cgi?id=178386
<rdar://problem/35027610>

Reviewed by Saam Barati.

JSTests:

• stress/regress-178386.js: Added.

Source/JavaScriptCore:

• runtime/JSONObject.cpp:

(JSC::Stringifier::appendStringifiedValue):

File:

• trunk/Source/JavaScriptCore/runtime/JSONObject.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/JSONObject.cpp

@@ -356 +356 @@
 
     if (value.isString()) {
-        builder.appendQuotedJSONString(asString(value)->value(m_exec));
+        const String& string = asString(value)->value(m_exec);
+        RETURN_IF_EXCEPTION(scope, StringifyFailed);
+        builder.appendQuotedJSONString(string);
         return StringifySucceeded;
     }