Fix assertion 'ret_value == ecma_make_empty_completion_value ()' fail in JSON.stringify()

JerryScript-DCO-1.0-Signed-off-by: Roland Takacs rtakacs.u-szeged@partner.samsung.com

jerry-core/ecma/builtin-objects/ecma-builtin-json.cpp

@@ -1028,6 +1028,8 @@ ecma_builtin_json_stringify (ecma_value_t this_arg __attr_unused___, /**< 'this'
     }
   }
 
+  if (ecma_is_completion_value_empty (ret_value))
+  {
     ecma_value_t space = ecma_copy_value (arg3, true);
 
     /* 5. */
@@ -1062,6 +1064,8 @@ ecma_builtin_json_stringify (ecma_value_t this_arg __attr_unused___, /**< 'this'
       }
     }
 
+    if (ecma_is_completion_value_empty (ret_value))
+    {
       /* 6. */
       if (ecma_is_value_number (space))
       {
@@ -1114,9 +1118,12 @@ ecma_builtin_json_stringify (ecma_value_t this_arg __attr_unused___, /**< 'this'
       {
         context.gap_str_p = ecma_get_magic_string (LIT_MAGIC_STRING__EMPTY);
       }
+    }
 
     ecma_free_value (space, true);
 
+    if (ecma_is_completion_value_empty (ret_value))
+    {
       /* 9. */
       ecma_object_t *obj_wrapper_p = ecma_create_object (NULL, true, ECMA_OBJECT_TYPE_GENERAL);
       ecma_string_t *empty_str_p = ecma_get_magic_string (LIT_MAGIC_STRING__EMPTY);
@@ -1141,9 +1148,12 @@ ecma_builtin_json_stringify (ecma_value_t this_arg __attr_unused___, /**< 'this'
 
       ecma_deref_object (obj_wrapper_p);
       ecma_deref_ecma_string (empty_str_p);
+    }
+
+    ecma_deref_ecma_string (context.gap_str_p);
+  }
 
   ecma_deref_ecma_string (context.indent_str_p);
-  ecma_deref_ecma_string (context.gap_str_p);
 
   ecma_free_values_collection (context.property_list_p, true);
   ecma_free_values_collection (context.occurence_stack_p, true);

tests/jerry/json-stringify.js

@@ -133,6 +133,21 @@ assert (JSON.stringify (object, replacer_function) == '{"c":3,"b":"JSON","a":"FO
 filter = ["a", "b"];
 assert (JSON.stringify (object, filter) == '{"a":"JSON","b":"JSON"}');
 
+number = new Number(2.2);
+number.toString = {};
+number.valueOf = [];
+
+try
+{
+  JSON.stringify([], [number]);
+  // Should not be reached.
+  assert (false);
+}
+catch (e)
+{
+  assert (e instanceof TypeError);
+}
+
 // Throw error in the replacer function
 function replacer_thrower (key, value)
 {