Fixing crash in V8ValueConverter.

content/renderer/v8_value_converter_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/v8_value_converter_impl.h"
 
 #include <string>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 293 matching lines @@
 
   scoped_ptr<DictionaryValue> result(new DictionaryValue());
   v8::Handle<v8::Array> property_names(val->GetPropertyNames());
 
   if (unique_set)
     unique_set->insert(val->GetIdentityHash());
 
   for (uint32 i = 0; i < property_names->Length(); ++i) {
     v8::Handle<v8::Value> key(property_names->Get(i));
 
-    if (!key->IsString() || !val->HasRealNamedProperty(key->ToString()))
+    // Skip this child if:
+    //  - |key| is not a string
+    //  - A property does not actually exist with |key|
+    //  - The property is actually a named callback and the object has internal
+    //    fields
+    // The last case still allows for accessor defined via __defineGetter__, but
+    // skips objects that have internally defined fields. Objects with
+    // internal named callbacks (like DOM input elements) are not meant to be
+    // converted and causes crashes: crbug.com/139933
+    if (!key->IsString() ||

[Aaron Boodman, 2012/08/02 18:13:44]

Would be more clear like:

// base::DictionaryValue can only have string properties.
// Anyway, this is probably an Array.
if (!key->IsString())
  continue;

// Whatever the reason for this is here...
if (!val->HasRealNamedProperty(key->ToString())
  continue;

... etc ...

[eaugusti, 2012/08/02 19:44:53]

Done.

+        !val->HasRealNamedProperty(key->ToString()) ||
+        (val->HasRealNamedCallbackProperty(key->ToString()) &&

[Aaron Boodman, 2012/08/02 18:13:44]

I think it is fine to just skip getters all together.

[eaugusti, 2012/08/02 19:44:53]

Done.

+            val->InternalFieldCount()))
       continue;
 
     v8::String::Utf8Value name_utf8(key->ToString());
 
     v8::TryCatch try_catch;
     v8::Handle<v8::Value> child_v8 = val->Get(key);
 
     if (try_catch.HasCaught()) {
       LOG(ERROR) << "Getter for property " << *name_utf8
                  << " threw an exception.";
@@ skipping 25 matching lines @@
     // We can avoid all bugs related to this by stripping null.
     if (strip_null_from_objects_ && child->IsType(Value::TYPE_NULL))
       continue;
 
     result->SetWithoutPathExpansion(std::string(*name_utf8, name_utf8.length()),
                                     child.release());
   }
 
   return result.release();
 }