Fixing crash in V8ValueConverter.

content/renderer/v8_value_converter_impl.cc

Index: content/renderer/v8_value_converter_impl.cc
diff --git a/content/renderer/v8_value_converter_impl.cc b/content/renderer/v8_value_converter_impl.cc
index dc76394da5c61202cc90a57952109143538ea8ec..8c62897bc94f3e64efbdc8f7ccd7ecac33b2bb74 100644
--- a/content/renderer/v8_value_converter_impl.cc
+++ b/content/renderer/v8_value_converter_impl.cc
@@ -311,7 +311,18 @@ Value* V8ValueConverterImpl::FromV8Object(
   for (uint32 i = 0; i < property_names->Length(); ++i) {
     v8::Handle<v8::Value> key(property_names->Get(i));
 
-    if (!key->IsString() || !val->HasRealNamedProperty(key->ToString()))
+    // base::DictionaryValue can only have string properties.
+    if (!key->IsString())
+      continue;
+
+    // Ensure that the property actually exists.
+    if (!val->HasRealNamedProperty(key->ToString()))
+      continue;
+
+    // Skip named callbacks from objects that have internal fields:
+    // crbug.com/139933
+    if (val->InternalFieldCount() > 0 &&
+        val->HasRealNamedCallbackProperty(key->ToString()))

[Aaron Boodman, 2012/08/04 11:34:19]

Please add braces since the if statement is more than two lines total.

[eaugusti, 2012/08/04 19:10:37]

Done.

       continue;
 
     v8::String::Utf8Value name_utf8(key->ToString());