DevTools: Fix tainted Function.prototype methods may disable console.

Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp

Index: Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp
diff --git a/Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp
index 6339b35ee0eaf707f2d36f36ae4271dc1a6f5fdd..dd02a7ee38c6fb034411b5effb7ef81fdb1e38fe 100644
--- a/Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/bindings/core/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -473,25 +473,46 @@ void V8InjectedScriptHost::unmonitorFunctionMethodCustom(const v8::FunctionCallb
     host->unmonitorFunction(scriptId, lineNumber, columnNumber);
 }
 
-void V8InjectedScriptHost::suppressWarningsAndCallMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
+void V8InjectedScriptHost::callFunctionMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
-    if (info.Length() < 2 || !info[0]->IsObject() || !info[1]->IsFunction())
+    if (info.Length() < 2 || info.Length() > 3 || !info[0]->IsFunction()) {
+        ASSERT_NOT_REACHED();
         return;
+    }
 
-    InjectedScriptHost* host = V8InjectedScriptHost::toNative(info.Holder());
-    ScriptDebugServer& debugServer = host->scriptDebugServer();
-    debugServer.muteWarningsAndDeprecations();
+    v8::Handle<v8::Function> function = v8::Handle<v8::Function>::Cast(info[0]);
+    v8::Handle<v8::Value> receiver = info[1];
+
+    if (info.Length() < 3 || info[2]->IsUndefined()) {
+        v8::Local<v8::Value> result = function->Call(receiver, 0, 0);
+        v8SetReturnValue(info, result);
+        return;
+    }
+
+    if (!info[2]->IsArray()) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
 
-    v8::Handle<v8::Object> receiver = v8::Handle<v8::Object>::Cast(info[0]);
-    v8::Handle<v8::Function> function = v8::Handle<v8::Function>::Cast(info[1]);
-    size_t argc = info.Length() - 2;
+    v8::Handle<v8::Array> arguments = v8::Handle<v8::Array>::Cast(info[2]);
+    size_t argc = arguments->Length();
     OwnPtr<v8::Handle<v8::Value>[]> argv = adoptArrayPtr(new v8::Handle<v8::Value>[argc]);
     for (size_t i = 0; i < argc; ++i)
-        argv[i] = info[i + 2];
+        argv[i] = arguments->Get(i);
 
     v8::Local<v8::Value> result = function->Call(receiver, argc, argv.get());
-    debugServer.unmuteWarningsAndDeprecations();
     v8SetReturnValue(info, result);
 }
 
+void V8InjectedScriptHost::suppressWarningsAndCallFunctionMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
+{
+    InjectedScriptHost* host = V8InjectedScriptHost::toNative(info.Holder());
+    ScriptDebugServer& debugServer = host->scriptDebugServer();
+    debugServer.muteWarningsAndDeprecations();
+
+    callFunctionMethodCustom(info);
+
+    debugServer.unmuteWarningsAndDeprecations();
+}
+
 } // namespace blink