From bfbe1821b59db5234c4960d5e3ab785158e8b175 Mon Sep 17 00:00:00 2001
From: Youngil Choi <duddlf.choi@samsung.com>
Date: Wed, 31 Aug 2016 20:25:15 +0900
Subject: [PATCH] vm_op_set_value should be able to throw error when
 ecma_op_to_string throws

JerryScript-DCO-1.0-Signed-off-by: Youngil Choi duddlf.choi@samsung.com
---
 jerry-core/vm/vm.c                        |  2 +-
 tests/jerry/regression-test-issue-1309.js | 31 +++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 tests/jerry/regression-test-issue-1309.js

diff --git a/jerry-core/vm/vm.c b/jerry-core/vm/vm.c
index 0a4395b7e..b63690937 100644
--- a/jerry-core/vm/vm.c
+++ b/jerry-core/vm/vm.c
@@ -143,7 +143,7 @@ vm_op_set_value (ecma_value_t object, /**< base object */
     ecma_value_t to_string = ecma_op_to_string (property);
     ecma_fast_free_value (property);
 
-    if (ECMA_IS_VALUE_ERROR (property))
+    if (ECMA_IS_VALUE_ERROR (to_string))
     {
       ecma_free_value (object);
       return to_string;
diff --git a/tests/jerry/regression-test-issue-1309.js b/tests/jerry/regression-test-issue-1309.js
new file mode 100644
index 000000000..1bda41b4d
--- /dev/null
+++ b/tests/jerry/regression-test-issue-1309.js
@@ -0,0 +1,31 @@
+// Copyright 2016 Samsung Electronics Co., Ltd.
+// Copyright 2016 University of Szeged.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var errorMessage = "toStringThrows"
+
+var toStringThrows = {
+  toString : function() {
+    throw new Error(errorMessage);
+  }
+}
+
+try {
+  var obj = {};
+  obj[toStringThrows] = 3;
+  assert(false);
+} catch (e) {
+  assert(e.message == errorMessage);
+}
+