Fixes a crash when entering a negative index with chrome.tabs.move ....

chrome/renderer/resources/json_schema.js

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // -----------------------------------------------------------------------------
 // NOTE: If you change this file you need to touch renderer_resources.grd to
 // have your change take effect.
 // -----------------------------------------------------------------------------
 
 //==============================================================================
@@ skipping 87 matching lines @@
   return message;
 };
 
 /**
  * Classifies a value as one of the JSON schema primitive types. Note that we
  * don't explicitly disallow 'function', because we want to allow functions in
  * the input values.
  */
 chromeHidden.JSONSchemaValidator.getType = function(value) {
   var s = typeof value;
-
+  var maxInt = -1 >>> 1;

[Aaron Boodman, 2010/11/18 23:04:35]

This is not the largest representable integer in JavaScript. That honor goes to
Math.pow(2, 53). For background on why this is, see:
http://en.wikipedia.org/wiki/Double_precision

   if (s == "object") {
     if (value === null) {
       return "null";
     } else if (value instanceof Array ||
                Object.prototype.toString.call(value) == "[Object Array]") {
       return "array";
     }
   } else if (s == "number") {
-    if (value % 1 == 0) {
+    if ((value % 1 == 0) && (Math.abs(value) <= maxInt)) {
       return "integer";
     }
   }
 
   return s;
 };
 
 /**
  * Add types that may be referenced by validated schemas that reference them
  * with "$ref": <typeId>. Each type must be a valid schema and define an
@@ skipping 245 matching lines @@
       }
     }
   }
 };
 
 /**
  * Validates a string and populates the errors property.
  */
 chromeHidden.JSONSchemaValidator.prototype.validateString = function(
     instance, schema, path) {
-  if (schema.minLength && instance.length < schema.minLength)
+  if ('minLength' in schema && instance.length < schema.minLength)
     this.addError(path, "stringMinLength", [schema.minLength]);
 
-  if (schema.maxLength && instance.length > schema.maxLength)
+  if ('maxLength' in schema && instance.length > schema.maxLength)
     this.addError(path, "stringMaxLength", [schema.maxLength]);
 
   if (schema.pattern && !schema.pattern.test(instance))
     this.addError(path, "stringPattern", [schema.pattern]);
 };
 
 /**
  * Validates a number and populates the errors property. The instance is
  * assumed to be a number.
  */
 chromeHidden.JSONSchemaValidator.prototype.validateNumber = function(
     instance, schema, path) {
 
   // Forbid NaN, +Infinity, and -Infinity.  Our APIs don't use them, and
   // JSON serialization encodes them as 'null'.  Re-evaluate supporting
   // them if we add an API that could reasonably take them as a parameter.
   if (isNaN(instance) ||
       instance == Number.POSITIVE_INFINITY ||
       instance == Number.NEGATIVE_INFINITY )
     this.addError(path, "numberFiniteNotNan", [instance]);
 
-  if (schema.minimum && instance < schema.minimum)
+  if ('minimum' in schema && instance < schema.minimum)
     this.addError(path, "numberMinValue", [schema.minimum]);
 
-  if (schema.maximum && instance > schema.maximum)
+  if ('maximum' in schema && instance > schema.maximum)
     this.addError(path, "numberMaxValue", [schema.maximum]);
 
   if (schema.maxDecimal && instance * Math.pow(10, schema.maxDecimal) % 1)
     this.addError(path, "numberMaxDecimal", [schema.maxDecimal]);
 };
 
 /**
  * Validates the primitive type of an instance and populates the errors
  * property. Returns true if the instance validates, false otherwise.
  */
@@ skipping 16 matching lines @@
  */
 chromeHidden.JSONSchemaValidator.prototype.addError = function(
     path, key, replacements) {
   this.errors.push({
     path: path,
     message: chromeHidden.JSONSchemaValidator.formatError(key, replacements)
   });
 };
 
 })();