DevTools: Fix tainted Function.prototype methods may disable console.

Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp

 /*
  * Copyright (C) 2007-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 455 matching lines @@
     String scriptId;
     int lineNumber;
     int columnNumber;
     if (!getFunctionLocation(info, &scriptId, &lineNumber, &columnNumber))
         return;
 
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(info.Holder());
     host->unmonitorFunction(scriptId, lineNumber, columnNumber);
 }
 
-void V8InjectedScriptHost::suppressWarningsAndCallMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
+void V8InjectedScriptHost::callFunctionMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
-    if (info.Length() < 2 || !info[0]->IsObject() || !info[1]->IsFunction())
+    if (info.Length() < 2 || info.Length() > 3 || !info[0]->IsFunction()) {
+        ASSERT_NOT_REACHED();
         return;
+    }
+    if (info.Length() == 3 && !info[2]->IsArray()) {
+        ASSERT_NOT_REACHED();

[yurys, 2014/08/07 16:54:03]

In theory InjectedScriptHost can leak into the page script in which case the
page can pass whatever it wants into this method. But probably it's fine to
leave the assert to check valid cases in the tests.

+        return;
+    }
 
+    v8::Handle<v8::Function> function = v8::Handle<v8::Function>::Cast(info[0]);
+    v8::Handle<v8::Value> receiver = info[1];
+
+    if (info.Length() < 3) {
+        v8::Local<v8::Value> result = function->Call(receiver, 0, 0);
+        v8SetReturnValue(info, result);
+        return;
+    }
+
+    v8::Handle<v8::Array> arguments = v8::Handle<v8::Array>::Cast(info[2]);
+    size_t argc = arguments->Length();
+    OwnPtr<v8::Handle<v8::Value>[]> argv = adoptArrayPtr(new v8::Handle<v8::Value>[argc]);
+    for (size_t i = 0; i < argc; ++i)
+        argv[i] = arguments->Get(i);
+
+    v8::Local<v8::Value> result = function->Call(receiver, argc, argv.get());
+    v8SetReturnValue(info, result);
+}
+
+void V8InjectedScriptHost::suppressWarningsAndCallFunctionMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
+{
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(info.Holder());
     ScriptDebugServer& debugServer = host->scriptDebugServer();
     debugServer.muteWarningsAndDeprecations();
 
-    v8::Handle<v8::Object> receiver = v8::Handle<v8::Object>::Cast(info[0]);
-    v8::Handle<v8::Function> function = v8::Handle<v8::Function>::Cast(info[1]);
-    size_t argc = info.Length() - 2;
-    OwnPtr<v8::Handle<v8::Value>[]> argv = adoptArrayPtr(new v8::Handle<v8::Value>[argc]);
-    for (size_t i = 0; i < argc; ++i)
-        argv[i] = info[i + 2];
+    callFunctionMethodCustom(info);
 
-    v8::Local<v8::Value> result = function->Call(receiver, argc, argv.get());
     debugServer.unmuteWarningsAndDeprecations();
-    v8SetReturnValue(info, result);
 }
 
 } // namespace blink