Index: content/renderer/pepper/v8_var_converter.cc |
diff --git a/content/renderer/pepper/v8_var_converter.cc b/content/renderer/pepper/v8_var_converter.cc |
index f36f8cf5759e3b447e1c06274ebd48ad598ec1a9..3c3503046a9ab3dbc2dfba51a9fcfbd7e2add162 100644 |
--- a/content/renderer/pepper/v8_var_converter.cc |
+++ b/content/renderer/pepper/v8_var_converter.cc |
@@ -155,7 +155,15 @@ bool GetOrCreateV8Value(v8::Handle<v8::Context> context, |
*result = v8::Object::New(isolate); |
break; |
case PP_VARTYPE_OBJECT: { |
- DCHECK(object_vars_allowed == V8VarConverter::kAllowObjectVars); |
+ // If object vars are disallowed, we should never be passed an object var |
+ // to convert. Also, we should never expect to convert an object var which |
+ // is nested inside an array or dictionary. |
+ if (object_vars_allowed == V8VarConverter::kDisallowObjectVars || |
+ visited_ids->size() != 0) { |
+ NOTREACHED(); |
+ result->Clear(); |
+ return false; |
+ } |
scoped_refptr<V8ObjectVar> v8_object_var = V8ObjectVar::FromPPVar(var); |
if (!v8_object_var.get()) { |
NOTREACHED(); |
@@ -225,9 +233,15 @@ bool GetOrCreateVar(v8::Handle<v8::Value> val, |
} else if (val->IsString() || val->IsStringObject()) { |
v8::String::Utf8Value utf8(val->ToString()); |
*result = StringVar::StringToPPVar(std::string(*utf8, utf8.length())); |
- } else if (val->IsArray()) { |
- *result = (new ArrayVar())->GetPPVar(); |
} else if (val->IsObject()) { |
+ // For any other v8 objects, the conversion happens as follows: |
+ // 1) If the object is an array buffer, return an ArrayBufferVar. |
+ // 2) If object vars are allowed, return the object wrapped as a |
+ // V8ObjectVar. This is to maintain backward compatibility with |
+ // synchronous scripting in Flash. |
+ // 3) If the object is an array, return an ArrayVar. |
+ // 4) If the object can be converted to a resource, return the ResourceVar. |
+ // 5) Otherwise return a DictionaryVar. |
scoped_ptr<blink::WebArrayBuffer> web_array_buffer( |
blink::WebArrayBufferConverter::createFromV8Value(val, isolate)); |
if (web_array_buffer.get()) { |
@@ -238,6 +252,8 @@ bool GetOrCreateVar(v8::Handle<v8::Value> val, |
v8::Handle<v8::Object> object = val->ToObject(); |
*result = content::HostGlobals::Get()-> |
host_var_tracker()->V8ObjectVarForV8Object(instance, object); |
+ } else if (val->IsArray()) { |
+ *result = (new ArrayVar())->GetPPVar(); |
} else { |
bool was_resource; |
if (!resource_converter->FromV8Value( |