Handle exception when retrieving toJSON function in JSON.stringify.

R=mvstanton@chromium.org
BUG=349335
LOG=N

Review URL: https://codereview.chromium.org/187603002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19670 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/json-stringifier.h

@@ -360,6 +360,7 @@ Handle<Object> BasicJsonStringifier::ApplyToJsonFunction(
   PropertyAttributes attr;
   Handle<Object> fun =
       Object::GetProperty(object, object, &lookup, tojson_string_, &attr);
+  if (fun.is_null()) return Handle<Object>::null();
   if (!fun->IsJSFunction()) return object;
 
   // Call toJSON function.

test/mjsunit/json2.js

@@ -105,6 +105,10 @@ var tojson_via_getter = { get toJSON() {
                           a: 1 };
 TestStringify('321', tojson_via_getter);
 
+assertThrows(function() {
+  JSON.stringify({ get toJSON() { throw "error"; } });
+});
+
 // Test toJSON with key.
 tojson_obj = { toJSON: function(key) { return key + key; } };
 var tojson_with_key_1 = { a: tojson_obj, b: tojson_obj };