From ee16308fe890df46b46065b683dbdb29d83911a3 Mon Sep 17 00:00:00 2001
From: Dmitry Volyntsev <xeioex@nginx.com>
Date: Tue, 7 Jul 2020 12:23:46 +0000
Subject: [PATCH] Fixed String.prototype.replace() when replacer throws
 exception.

This issue was introduced in 1c729f765cfb.
Found by Clang static analyzer.
---
 src/njs_string.c         | 4 ++++
 src/test/njs_unit_test.c | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/src/njs_string.c b/src/njs_string.c
index 260c9b02..27f76f9f 100644
--- a/src/njs_string.c
+++ b/src/njs_string.c
@@ -3601,6 +3601,10 @@ njs_string_prototype_replace(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
                                 njs_value_arg(&njs_value_undefined),
                                 arguments, 3, &retval);
 
+        if (njs_slow_path(ret != NJS_OK)) {
+            return ret;
+        }
+
         ret = njs_value_to_string(vm, &retval, &retval);
         if (njs_slow_path(ret != NJS_OK)) {
             return NJS_ERROR;
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index fe8ebd6b..6146fdd8 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -7523,6 +7523,9 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("'12345'.replace(3, () => ({toString: () => 'aaaa'}))"),
       njs_str("12aaaa45") },
 
+    { njs_str("'ABC'.replace('B', () => {throw 'OOps'})"),
+      njs_str("OOps") },
+
     { njs_str("'abc'.replace(/a/, 'X')"),
       njs_str("Xbc") },
 
-- 
2.47.3