DevTools: Fix tainted Function.prototype methods may disable console.

Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp

Index: Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp
diff --git a/Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp
index 6339b35ee0eaf707f2d36f36ae4271dc1a6f5fdd..2a39ed306b61fe4ca2b8ce7458bed12c2b3b6e54 100644
--- a/Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -473,25 +473,45 @@ void V8InjectedScriptHost::unmonitorFunctionMethodCustom(const v8::FunctionCallb
     host->unmonitorFunction(scriptId, lineNumber, columnNumber);
 }
 
-void V8InjectedScriptHost::suppressWarningsAndCallMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
+void V8InjectedScriptHost::callFunctionMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
-    if (info.Length() < 2 || !info[0]->IsObject() || !info[1]->IsFunction())
+    if (info.Length() < 2 || info.Length() > 3 || !info[0]->IsFunction()) {
+        ASSERT_NOT_REACHED();
         return;
+    }
+    if (info.Length() == 3 && !info[2]->IsArray()) {
+        ASSERT_NOT_REACHED();

[yurys, 2014/08/07 16:54:03]

In theory InjectedScriptHost can leak into the page script in which case the
page can pass whatever it wants into this method. But probably it's fine to
leave the assert to check valid cases in the tests.

+        return;
+    }
 
-    InjectedScriptHost* host = V8InjectedScriptHost::toNative(info.Holder());
-    ScriptDebugServer& debugServer = host->scriptDebugServer();
-    debugServer.muteWarningsAndDeprecations();
+    v8::Handle<v8::Function> function = v8::Handle<v8::Function>::Cast(info[0]);
+    v8::Handle<v8::Value> receiver = info[1];
 
-    v8::Handle<v8::Object> receiver = v8::Handle<v8::Object>::Cast(info[0]);
-    v8::Handle<v8::Function> function = v8::Handle<v8::Function>::Cast(info[1]);
-    size_t argc = info.Length() - 2;
+    if (info.Length() < 3) {
+        v8::Local<v8::Value> result = function->Call(receiver, 0, 0);
+        v8SetReturnValue(info, result);
+        return;
+    }
+
+    v8::Handle<v8::Array> arguments = v8::Handle<v8::Array>::Cast(info[2]);
+    size_t argc = arguments->Length();
     OwnPtr<v8::Handle<v8::Value>[]> argv = adoptArrayPtr(new v8::Handle<v8::Value>[argc]);
     for (size_t i = 0; i < argc; ++i)
-        argv[i] = info[i + 2];
+        argv[i] = arguments->Get(i);
 
     v8::Local<v8::Value> result = function->Call(receiver, argc, argv.get());
-    debugServer.unmuteWarningsAndDeprecations();
     v8SetReturnValue(info, result);
 }
 
+void V8InjectedScriptHost::suppressWarningsAndCallFunctionMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
+{
+    InjectedScriptHost* host = V8InjectedScriptHost::toNative(info.Holder());
+    ScriptDebugServer& debugServer = host->scriptDebugServer();
+    debugServer.muteWarningsAndDeprecations();
+
+    callFunctionMethodCustom(info);
+
+    debugServer.unmuteWarningsAndDeprecations();
+}
+
 } // namespace blink