JSON serializer should fail gracefully for special value wrappers.

R=mstarzinger@chromium.org
BUG=chromium:471702
LOG=N

Review URL: https://codereview.chromium.org/1120573002

Cr-Commit-Position: refs/heads/master@{#28154}

src/json-stringifier.h

@@ -396,11 +396,14 @@ BasicJsonStringifier::Result BasicJsonStringifier::SerializeJSValue(
         isolate_, value, Execution::ToNumber(isolate_, object), EXCEPTION);
     if (value->IsSmi()) return SerializeSmi(Smi::cast(*value));
     SerializeHeapNumber(Handle<HeapNumber>::cast(value));
-  } else {
-    DCHECK(class_name == isolate_->heap()->Boolean_string());
+  } else if (class_name == isolate_->heap()->Boolean_string()) {
     Object* value = JSValue::cast(*object)->value();
     DCHECK(value->IsBoolean());
     builder_.AppendCString(value->IsTrue() ? "true" : "false");
+  } else {
+    // Fail gracefully for special value wrappers.
+    isolate_->ThrowIllegalOperation();
+    return EXCEPTION;
   }
   return SUCCESS;
 }

test/mjsunit/regress/regress-crbug-471702.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertThrows(function() { JSON.stringify(%DebugGetLoadedScripts()); });