Handle exception when retrieving toJSON function in JSON.stringify.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 342 matching lines @@
 
 
 Handle<Object> BasicJsonStringifier::ApplyToJsonFunction(
     Handle<Object> object, Handle<Object> key) {
   LookupResult lookup(isolate_);
   JSObject::cast(*object)->LookupRealNamedProperty(*tojson_string_, &lookup);
   if (!lookup.IsProperty()) return object;
   PropertyAttributes attr;
   Handle<Object> fun =
       Object::GetProperty(object, object, &lookup, tojson_string_, &attr);
+  if (fun.is_null()) return Handle<Object>::null();
   if (!fun->IsJSFunction()) return object;
 
   // Call toJSON function.
   if (key->IsSmi()) key = factory_->NumberToString(key);
   Handle<Object> argv[] = { key };
   bool has_exception = false;
   HandleScope scope(isolate_);
   object = Execution::Call(isolate_, fun, object, 1, argv, &has_exception);
   // Return empty handle to signal an exception.
   if (has_exception) return Handle<Object>::null();
@@ skipping 473 matching lines @@
       SerializeString_<false, uint8_t>(object);
     } else {
       SerializeString_<false, uc16>(object);
     }
   }
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_JSON_STRINGIFIER_H_