Turn crash in JSON.stringify into introspection error (#2412)

Summary: Release notes: None Fixes #2411 Pull Request resolved: #2412 Differential Revision: D9259046 Pulled By: sb98052 fbshipit-source-id: 392b6aa9bc840e72d61f26929e5cc110230c75d0
facebookarchive · Aug 10, 2018 · 9fb1e34 · 9fb1e34
1 parent 22a55f7
commit 9fb1e34
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/src/intrinsics/ecma262/JSON.js b/src/intrinsics/ecma262/JSON.js
@@ -478,8 +478,16 @@ export default function(realm: Realm): ObjectValue {
     // 9. Let wrapper be ObjectCreate(%ObjectPrototype%).
     let wrapper = Create.ObjectCreate(realm, realm.intrinsics.ObjectPrototype);
 
+    let isAbstract = value instanceof AbstractValue;
+
+    // #2411
+    if (isAbstract && value.values.isTop()) {
+      AbstractValue.reportIntrospectionError(value);
+      throw new FatalError();
+    }
+
     // TODO #1012: Make result abstract if any nested element is an abstract value.
-    if (value instanceof AbstractValue || (value instanceof ObjectValue && value.isPartialObject())) {
+    if (isAbstract || (value instanceof ObjectValue && value.isPartialObject())) {
       // Return abstract result. This enables cloning via JSON.parse(JSON.stringify(...)).
       let clonedValue = InternalJSONClone(realm, value);
       let result = AbstractValue.createTemporalFromTemplate(realm, JSONStringify, StringValue, [clonedValue], {

diff --git a/test/serializer/abstract/JSONStringifyOnAbstract2411.js b/test/serializer/abstract/JSONStringifyOnAbstract2411.js
@@ -0,0 +1,9 @@
+// throws introspection error
+//
+(function() {
+  let o = __abstract("object", "(o)");
+  let s;
+  s = "A" + JSON.stringify(o);
+
+  global.s = s;
+})();