diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index d577f76..7d9c572 100644
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,13 @@
+2019-12-04  Mark Lam  <mark.lam@apple.com>
+
+        Fix missing exception check in ArrayPrototype's fastJoin().
+        https://bugs.webkit.org/show_bug.cgi?id=204868
+        <rdar://problem/57516684>
+
+        Reviewed by Saam Barati.
+
+        * stress/missing-exception-check-in-array-prototype-fastJoin.js: Added.
+
 2019-12-04  Yusuke Suzuki  <ysuzuki@apple.com>
 
         Unreviewed, rolling out r252416, vimeo does not work
diff --git a/JSTests/stress/missing-exception-check-in-array-prototype-fastJoin.js b/JSTests/stress/missing-exception-check-in-array-prototype-fastJoin.js
new file mode 100644
index 0000000..aa35820
--- /dev/null
+++ b/JSTests/stress/missing-exception-check-in-array-prototype-fastJoin.js
@@ -0,0 +1,11 @@
+//@ runDefault
+
+try {
+    const s = (10).toLocaleString().padEnd(2**31-1, 'aa');
+    RegExp([s]);
+} catch (e) {
+    exception = e;
+}
+
+if (exception != "Error: Out of memory")
+    throw "FAILED";
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 50a3e97..2aa9f5a 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,5 +1,16 @@
 2019-12-04  Mark Lam  <mark.lam@apple.com>
 
+        Fix missing exception check in ArrayPrototype's fastJoin().
+        https://bugs.webkit.org/show_bug.cgi?id=204868
+        <rdar://problem/57516684>
+
+        Reviewed by Saam Barati.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::fastJoin):
+
+2019-12-04  Mark Lam  <mark.lam@apple.com>
+
         Fix a broken assertion in GetByStatus::computeForStubInfoWithoutExitSiteFeedback().
         https://bugs.webkit.org/show_bug.cgi?id=204866
 
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index cb773d4..0a7ae4e 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -490,6 +490,7 @@
             if (JSValue value = data[i].get()) {
                 if (!joiner.appendWithoutSideEffects(globalObject, value))
                     goto generalCase;
+                RETURN_IF_EXCEPTION(scope, { });
             } else {
                 if (sawHoles)
                     *sawHoles = true;