Don't trigger Object.prototype setters when generating completions

Don't trigger Object.prototype setters when generating completions

Autocomplete gets its candidates for completion by running a function in
the context of the page. If we use a plain object to hold results, we'll
end up triggering any setters that the page added to Object.prototype.

Using a prototype-less object avoids this, but a page could still
interfere by replacing Object.create (or Object.getPrototypeOf, String,
Number, Boolean...).

BUG=645328
Committed: https://crrev.com/c1431e19823dc2a0487197185795ffbe20d5a88f
Cr-Commit-Position: refs/heads/master@{#417729}

[Sidney San Martín, 2016-09-09 03:15:22]

sdy@chromium.org changed reviewers:
+ alph@chromium.org

[Sidney San Martín, 2016-09-09 03:15:23]

Possible fix for crbug.com/645328.

[alph, 2016-09-09 10:14:44]

alph@chromium.org changed reviewers:
+ dgozman@chromium.org, lushnikov@chromium.org

[alph, 2016-09-09 10:14:44]

Thanks for the fix!
I'd like to have Lusha or dgozman to take a look.

https://codereview.chromium.org/2324093002/diff/1/third_party/WebKit/Source/d...
File third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js (right):

https://codereview.chromium.org/2324093002/diff/1/third_party/WebKit/Source/d...
third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js:690: var
resultSet = Object.create(null);
I'd rather use "new Set()" here.

[Sidney San Martín, 2016-09-09 12:09:25]

https://codereview.chromium.org/2324093002/diff/1/third_party/WebKit/Source/d...
File third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js (right):

https://codereview.chromium.org/2324093002/diff/1/third_party/WebKit/Source/d...
third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js:690: var
resultSet = Object.create(null);
On 2016/09/09 10:14:44, alph wrote:
> I'd rather use "new Set()" here.

It has to cross a process boundary as JSON, so I don't *think* Set is an option
— or it would need to be turned into an array or object later.

[dgozman, 2016-09-09 14:56:21]

https://codereview.chromium.org/2324093002/diff/1/third_party/WebKit/Source/d...
File third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js (right):

https://codereview.chromium.org/2324093002/diff/1/third_party/WebKit/Source/d...
third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js:690: var
resultSet = Object.create(null);
I think we use { __proto__: null } in InjectedScriptSource to avoid calling
overridden functions.

[Sidney San Martín, 2016-09-09 15:08:44]

Patchset #2 (id:20001) has been deleted

[Sidney San Martín, 2016-09-09 15:09:28]

https://codereview.chromium.org/2324093002/diff/1/third_party/WebKit/Source/d...
File third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js (right):

https://codereview.chromium.org/2324093002/diff/1/third_party/WebKit/Source/d...
third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js:690: var
resultSet = Object.create(null);
On 2016/09/09 14:56:21, dgozman wrote:
> I think we use { __proto__: null } in InjectedScriptSource to avoid calling
> overridden functions.

Oh, interesting. Done.

[dgozman, 2016-09-09 20:05:09]

lgtm. Thanks for the fix!

[Sidney San Martín, 2016-09-09 20:43:03]

The CQ bit was checked by sdy@chromium.org

[commit-bot: I haz the power, 2016-09-09 20:43:32]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-09 22:07:30]

Committed patchset #2 (id:40001)

[commit-bot: I haz the power, 2016-09-09 22:10:21]

Description was changed from

==========
Don't trigger Object.prototype setters when generating completions

Autocomplete gets its candidates for completion by running a function in
the context of the page. If we use a plain object to hold results, we'll
end up triggering any setters that the page added to Object.prototype.

Using a prototype-less object avoids this, but a page could still
interfere by replacing Object.create (or Object.getPrototypeOf, String,
Number, Boolean...).

BUG=645328
==========

to

==========
Don't trigger Object.prototype setters when generating completions

Autocomplete gets its candidates for completion by running a function in
the context of the page. If we use a plain object to hold results, we'll
end up triggering any setters that the page added to Object.prototype.

Using a prototype-less object avoids this, but a page could still
interfere by replacing Object.create (or Object.getPrototypeOf, String,
Number, Boolean...).

BUG=645328

Committed: https://crrev.com/c1431e19823dc2a0487197185795ffbe20d5a88f
Cr-Commit-Position: refs/heads/master@{#417729}
==========

[commit-bot: I haz the power, 2016-09-09 22:10:22]

Patchset 2 (id:??) landed as
https://crrev.com/c1431e19823dc2a0487197185795ffbe20d5a88f
Cr-Commit-Position: refs/heads/master@{#417729}