From 1ec09b0449fe796a0a452dbde2f4c39f968d4adf Mon Sep 17 00:00:00 2001
From: cjihrig <cjihrig@gmail.com>
Date: Tue, 1 Dec 2015 20:34:45 -0500
Subject: [PATCH] src: don't print garbage errors

If JS throws an object whose toString() method throws, then Node
attempts to print an empty message, but actually prints garbage.
This commit checks for this case, and prints a message instead.

Fixes: https://github.com/nodejs/node/issues/4079
PR-URL: https://github.com/nodejs/node/pull/4112
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Chris Dickinson <christopher.s.dickinson@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>
---
 src/node.cc                           | 6 ++++--
 test/fixtures/throws_error7.js        | 5 +++++
 test/parallel/test-error-reporting.js | 9 ++++++---
 3 files changed, 15 insertions(+), 5 deletions(-)
 create mode 100644 test/fixtures/throws_error7.js

diff --git a/src/node.cc b/src/node.cc
index d8681292aad36a..bf544c470d9472 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -1511,8 +1511,10 @@ static void ReportException(Environment* env,
         name.IsEmpty() ||
         name->IsUndefined()) {
       // Not an error object. Just print as-is.
-      node::Utf8Value message(env->isolate(), er);
-      PrintErrorString("%s\n", *message);
+      String::Utf8Value message(er);
+
+      PrintErrorString("%s\n", *message ? *message :
+                                          "<toString() threw exception>");
     } else {
       node::Utf8Value name_string(env->isolate(), name);
       node::Utf8Value message_string(env->isolate(), message);
diff --git a/test/fixtures/throws_error7.js b/test/fixtures/throws_error7.js
new file mode 100644
index 00000000000000..f730bc6def1ba9
--- /dev/null
+++ b/test/fixtures/throws_error7.js
@@ -0,0 +1,5 @@
+throw {
+  toString: function() {
+    throw this;
+  }
+};
diff --git a/test/parallel/test-error-reporting.js b/test/parallel/test-error-reporting.js
index 88ef5d306e3e37..b5b70eeb3b2add 100644
--- a/test/parallel/test-error-reporting.js
+++ b/test/parallel/test-error-reporting.js
@@ -24,8 +24,6 @@ function errExec(script, callback) {
 
     // Count the tests
     exits++;
-
-    console.log('.');
   });
 }
 
@@ -64,6 +62,11 @@ errExec('throws_error6.js', function(err, stdout, stderr) {
   assert.ok(/SyntaxError/.test(stderr));
 });
 
+// Object that throws in toString() doesn't print garbage
+errExec('throws_error7.js', function(err, stdout, stderr) {
+  assert.ok(/<toString\(\) threw exception/.test(stderr));
+});
+
 process.on('exit', function() {
-  assert.equal(6, exits);
+  assert.equal(7, exits);
 });