Enforce capability spec renderer <--> browser

content/browser/mojo/merge_dictionary.cc

Index: content/browser/mojo/merge_dictionary.cc
diff --git a/content/browser/mojo/merge_dictionary.cc b/content/browser/mojo/merge_dictionary.cc
new file mode 100644
index 0000000000000000000000000000000000000000..7571dc8529e4db27441fd42619f1b7b6e5760e2e
--- /dev/null
+++ b/content/browser/mojo/merge_dictionary.cc
@@ -0,0 +1,44 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/mojo/merge_dictionary.h"
+
+namespace content {
+
+void MergeDictionary(base::DictionaryValue* target,
+                     const base::DictionaryValue* source) {
+  for (base::DictionaryValue::Iterator it(*source); !it.IsAtEnd();
+       it.Advance()) {
+    const base::Value* merge_value = &it.value();
+    // Check whether we have to merge dictionaries.
+    if (merge_value->IsType(base::Value::TYPE_DICTIONARY)) {
+      base::DictionaryValue* sub_dict;
+      if (target->GetDictionaryWithoutPathExpansion(it.key(), &sub_dict)) {
+        MergeDictionary(
+            sub_dict,
+            static_cast<const base::DictionaryValue*>(merge_value));
+        continue;
+      }
+    }
+    if (merge_value->IsType(base::Value::TYPE_LIST)) {
+      const base::ListValue* merge_list = nullptr;
+      if (merge_value->GetAsList(&merge_list)) {
+        base::ListValue* target_list = nullptr;
+        CHECK(target->GetListWithoutPathExpansion(it.key(), &target_list));

[Ken Rockot(use gerrit already), 2016/09/14 22:15:17]

Likely this CHECK will be hit, which would explain the nullptr dereferences in
non-DCHECK builds like perf bots.

I don't think you want to CHECK. Rather, you want to fall through to the
deep-copy logic if the list doesn't already exist.

+        if (target_list) {
+          for (size_t i = 0; i < merge_list->GetSize(); ++i) {
+            std::string value;
+            CHECK(merge_list->GetString(i, &value));
+            target_list->AppendString(value);
+          }
+        }
+      }
+    } else {
+      // All other cases: Make a copy and hook it up.
+      target->SetWithoutPathExpansion(it.key(), merge_value->DeepCopy());
+    }
+  }
+}
+
+}  // namespace content