Fixing crash in V8ValueConverter.

content/renderer/v8_value_converter_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/v8_value_converter_impl.h"
 
 #include <string>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 293 matching lines @@
 
   scoped_ptr<DictionaryValue> result(new DictionaryValue());
   v8::Handle<v8::Array> property_names(val->GetPropertyNames());
 
   if (unique_set)
     unique_set->insert(val->GetIdentityHash());
 
   for (uint32 i = 0; i < property_names->Length(); ++i) {
     v8::Handle<v8::Value> key(property_names->Get(i));
 
-    if (!key->IsString() || !val->HasRealNamedProperty(key->ToString()))
+    // base::DictionaryValue can only have string properties.
+    if (!key->IsString())
+      continue;
+
+    // Ensure that the property actually exists.
+    if (!val->HasRealNamedProperty(key->ToString()))
+      continue;
+
+    // Skip all callbacks: crbug.com/139933
+    if (val->HasRealNamedCallbackProperty(key->ToString()))
       continue;
 
     v8::String::Utf8Value name_utf8(key->ToString());
 
     v8::TryCatch try_catch;
     v8::Handle<v8::Value> child_v8 = val->Get(key);
 
     if (try_catch.HasCaught()) {
       LOG(ERROR) << "Getter for property " << *name_utf8
                  << " threw an exception.";
@@ skipping 25 matching lines @@
     // We can avoid all bugs related to this by stripping null.
     if (strip_null_from_objects_ && child->IsType(Value::TYPE_NULL))
       continue;
 
     result->SetWithoutPathExpansion(std::string(*name_utf8, name_utf8.length()),
                                     child.release());
   }
 
   return result.release();
 }