Don't trigger Object.prototype setters when generating completions

third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js

Index: third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js
diff --git a/third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js b/third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js
index 50009bec4827d43cbcaca20a05d4744e0a6d0a1b..e761831898f2d99acb813fa064f88bcaac8ce6bf 100644
--- a/third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js
+++ b/third_party/WebKit/Source/devtools/front_end/sdk/RuntimeModel.js
@@ -686,7 +686,8 @@ WebInspector.ExecutionContext.prototype = {
                 else
                     object = this;
 
-                var resultSet = {};
+                // Avoid Object.prototype modifications from the page. @see crbug.com/645328
+                var resultSet = Object.create(null);

[alph, 2016/09/09 10:14:44]

I'd rather use "new Set()" here.

[Sidney San Martín, 2016/09/09 12:09:25]

It has to cross a process boundary as JSON, so I don't *think* Set is an option
— or it would need to be turned into an array or object later.

[dgozman, 2016/09/09 14:56:21]

I think we use { __proto__: null } in InjectedScriptSource to avoid calling
overridden functions.

[Sidney San Martín, 2016/09/09 15:09:28]

Oh, interesting. Done.

                 try {
                     for (var o = object; o; o = Object.getPrototypeOf(o)) {
                         if ((type === "array" || type === "typedarray") && o === object && ArrayBuffer.isView(o) && o.length > 9999)