Don't trigger Object.prototype setters when generating completions

third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 668 matching lines @@
                 var object;
                 if (type === "string")
                     object = new String("");
                 else if (type === "number")
                     object = new Number(0);
                 else if (type === "boolean")
                     object = new Boolean(false);
                 else
                     object = this;
 
-                var resultSet = {};
+                // Avoid Object.prototype modifications from the page. @see crbug.com/645328
+                var resultSet = Object.create(null);

[alph, 2016/09/09 10:14:44]

I'd rather use "new Set()" here.

[Sidney San Martín, 2016/09/09 12:09:25]

It has to cross a process boundary as JSON, so I don't *think* Set is an option
— or it would need to be turned into an array or object later.

[dgozman, 2016/09/09 14:56:21]

I think we use { __proto__: null } in InjectedScriptSource to avoid calling
overridden functions.

[Sidney San Martín, 2016/09/09 15:09:28]

Oh, interesting. Done.

                 try {
                     for (var o = object; o; o = Object.getPrototypeOf(o)) {
                         if ((type === "array" || type === "typedarray") && o === object && ArrayBuffer.isView(o) && o.length > 9999)
                             continue;
                         var names = Object.getOwnPropertyNames(o);
                         var isArray = Array.isArray(o);
                         for (var i = 0; i < names.length; ++i) {
                             // Skip array elements indexes.
                             if (isArray && /^[0-9]/.test(names[i]))
                                 continue;
@@ skipping 314 matching lines @@
     /**
      * @return {boolean}
      */
     isNormalListenerType: function()
     {
         return this._listenerType === "normal";
     },
 
     __proto__: WebInspector.SDKObject.prototype
 }