Fixing crash in V8ValueConverter.

content/renderer/v8_value_converter_impl_unittest.cc

Index: content/renderer/v8_value_converter_impl_unittest.cc
diff --git a/content/renderer/v8_value_converter_impl_unittest.cc b/content/renderer/v8_value_converter_impl_unittest.cc
index a4e461f390930877a1171e4288597a88056486bf..033aac4a66b0fd36fd2538f333523c8ed0420d07 100644
--- a/content/renderer/v8_value_converter_impl_unittest.cc
+++ b/content/renderer/v8_value_converter_impl_unittest.cc
@@ -10,6 +10,16 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "v8/include/v8.h"
 
+namespace {
+
+// A dumb getter for an object's named callback.
+v8::Handle<v8::Value> NamedCallbackGetter(v8::Local<v8::String> name,
+                                          const v8::AccessorInfo& info) {
+  return v8::String::New("bar");
+}
+
+}  // namespace
+
 class V8ValueConverterImplTest : public testing::Test {
  protected:
   virtual void SetUp() {
@@ -398,6 +408,25 @@ TEST_F(V8ValueConverterImplTest, ObjectGetters) {
   EXPECT_EQ(1u, result->size());
 }
 
+// Do not try and convert the named callbacks in objects with internal fields.
+TEST_F(V8ValueConverterImplTest, ObjectWithInternalFieldsGetters) {
+  v8::Context::Scope context_scope(context_);
+  v8::HandleScope handle_scope;
+
+  v8::Handle<v8::ObjectTemplate> object_template = v8::ObjectTemplate::New();
+  object_template->SetInternalFieldCount(1);
+  object_template->SetAccessor(v8::String::New("foo"), NamedCallbackGetter);
+  v8::Handle<v8::Object> object = object_template->NewInstance();
+  ASSERT_FALSE(object.IsEmpty());
+  object->Set(v8::String::New("a"), v8::String::New("b"));
+
+  V8ValueConverterImpl converter;
+  scoped_ptr<DictionaryValue> result(
+      static_cast<DictionaryValue*>(converter.FromV8Value(object, context_)));
+  ASSERT_TRUE(result.get());
+  EXPECT_EQ(1u, result->size());
+}
+
 TEST_F(V8ValueConverterImplTest, ArrayGetters) {
   v8::Context::Scope context_scope(context_);
   v8::HandleScope handle_scope;