Fix uninit read in TestRunner.

content/shell/renderer/test_runner/TestRunner.cpp

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2010 Pawel Hajdan (phajdan.jr@chromium.org)
  * Copyright (C) 2012 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 1314 matching lines @@
     if (arguments.size() < 2 || !arguments[0].isString() || !arguments[1].isBool())
         return;
     WebView::injectStyleSheet(
         cppVariantToWebString(arguments[0]), WebVector<WebString>(),
         arguments[1].toBoolean() ? WebView::InjectStyleInAllFrames : WebView::InjectStyleInTopFrameOnly);
 }
 
 void TestRunner::startSpeechInput(const CppArgumentList& arguments, CppVariant* result)
 {
     result->setNull();
-    if (arguments.size() != 1)
+    if (arguments.size() != 1 || !arguments[0].isObject())
         return;
 
     WebElement element;
     if (!WebBindings::getElement(arguments[0].value.objectValue, &element))
         return;
 
     WebInputElement* input = toWebInputElement(&element);
     if (!input)
         return;
 
@@ skipping 34 matching lines @@
 
     WebFrame* frame = m_webView->mainFrame();
     const bool findResult = frame->find(0, cppVariantToWebString(arguments[0]), findOptions, wrapAround, 0);
     frame->stopFinding(false);
     result->set(findResult);
 }
 
 void TestRunner::setValueForUser(const CppArgumentList& arguments, CppVariant* result)
 {
     result->setNull();
-    if (arguments.size() != 2)
+    if (arguments.size() != 2 || !arguments[0].isObject() || !arguments[0].isString())
         return;
 
     WebElement element;
     if (!WebBindings::getElement(arguments[0].value.objectValue, &element))
         return;
 
     WebInputElement* input = toWebInputElement(&element);
     if (!input)
         return;
 
@@ skipping 715 matching lines @@
     result->setNull();
 }
 
 void TestRunner::setPointerLockWillFailSynchronously(const CppArgumentList&, CppVariant* result)
 {
     m_pointerLockPlannedResult = PointerLockWillFailSync;
     result->setNull();
 }
 
 }