Fixing crash in V8ValueConverter.

content/renderer/v8_value_converter_impl_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cmath>
 
 #include "base/memory/scoped_ptr.h"
 #include "base/values.h"
 #include "content/renderer/v8_value_converter_impl.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "v8/include/v8.h"
 
+namespace {
+
+// A dumb getter for an object's named callback.
+v8::Handle<v8::Value> NamedCallbackGetter(v8::Local<v8::String> name,
+                                          const v8::AccessorInfo& info) {
+  return v8::String::New("bar");
+}
+
+}  // namespace
+
 class V8ValueConverterImplTest : public testing::Test {
  protected:
   virtual void SetUp() {
     v8::HandleScope handle_scope;
     v8::Handle<v8::ObjectTemplate> global = v8::ObjectTemplate::New();
     context_ = v8::Context::New(NULL, global);
   }
 
   virtual void TearDown() {
     context_.Dispose();
@@ skipping 368 matching lines @@
   v8::Handle<v8::Object> object = script->Run().As<v8::Object>();
   ASSERT_FALSE(object.IsEmpty());
 
   V8ValueConverterImpl converter;
   scoped_ptr<DictionaryValue> result(
       static_cast<DictionaryValue*>(converter.FromV8Value(object, context_)));
   ASSERT_TRUE(result.get());
   EXPECT_EQ(1u, result->size());
 }
 
+// Do not try and convert the named callbacks in objects with internal fields.
+TEST_F(V8ValueConverterImplTest, ObjectWithInternalFieldsGetters) {
+  v8::Context::Scope context_scope(context_);
+  v8::HandleScope handle_scope;
+
+  v8::Handle<v8::ObjectTemplate> object_template = v8::ObjectTemplate::New();
+  object_template->SetInternalFieldCount(1);
+  object_template->SetAccessor(v8::String::New("foo"), NamedCallbackGetter);
+  v8::Handle<v8::Object> object = object_template->NewInstance();
+  ASSERT_FALSE(object.IsEmpty());
+  object->Set(v8::String::New("a"), v8::String::New("b"));
+
+  V8ValueConverterImpl converter;
+  scoped_ptr<DictionaryValue> result(
+      static_cast<DictionaryValue*>(converter.FromV8Value(object, context_)));
+  ASSERT_TRUE(result.get());
+  EXPECT_EQ(1u, result->size());
+}
+
 TEST_F(V8ValueConverterImplTest, ArrayGetters) {
   v8::Context::Scope context_scope(context_);
   v8::HandleScope handle_scope;
 
   const char* source = "(function() {"
       "var a = [0];"
       "a.__defineGetter__(1, function() { return 'bar'; });"
       "return a;"
       "})();";
 
   v8::Handle<v8::Script> script(v8::Script::New(v8::String::New(source)));
   v8::Handle<v8::Array> array = script->Run().As<v8::Array>();
   ASSERT_FALSE(array.IsEmpty());
 
   V8ValueConverterImpl converter;
   scoped_ptr<ListValue> result(
       static_cast<ListValue*>(converter.FromV8Value(array, context_)));
   ASSERT_TRUE(result.get());
   EXPECT_EQ(2u, result->GetSize());
 }