From 292e96709c4501a4d84dd8ee3256ec0370ee921c Mon Sep 17 00:00:00 2001
From: Alexey Kozyatinskiy <kozyatinskiy@chromium.org>
Date: Tue, 11 Jul 2017 13:27:13 -0700
Subject: [PATCH] [inspector] catch exception during object.toString() call for
 console

Console methods should never throw an exception.

R=jgruber@chromium.org

Bug: chromium:736302
Change-Id: I05791b366d46a43b2a78825cbb8a82bb049110e6
Reviewed-on: https://chromium-review.googlesource.com/567434
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46573}
---
 src/inspector/v8-console.cc                   |  1 +
 .../runtime/regression-736302-expected.txt    | 82 +++++++++++++++++++
 test/inspector/runtime/regression-736302.js   | 40 +++++++++
 3 files changed, 123 insertions(+)
 create mode 100644 test/inspector/runtime/regression-736302-expected.txt
 create mode 100644 test/inspector/runtime/regression-736302.js

diff --git a/src/inspector/v8-console.cc b/src/inspector/v8-console.cc
index cf4b130e66..4d71adfd47 100644
--- a/src/inspector/v8-console.cc
+++ b/src/inspector/v8-console.cc
@@ -112,6 +112,7 @@ class ConsoleHelper {
   String16 firstArgToString(const String16& defaultValue) {
     if (m_info.Length() < 1) return defaultValue;
     v8::Local<v8::String> titleValue;
+    v8::TryCatch tryCatch(m_context->GetIsolate());
     if (m_info[0]->IsObject()) {
       if (!m_info[0].As<v8::Object>()->ObjectProtoToString(m_context).ToLocal(
               &titleValue))
diff --git a/test/inspector/runtime/regression-736302-expected.txt b/test/inspector/runtime/regression-736302-expected.txt
new file mode 100644
index 0000000000..17243f2745
--- /dev/null
+++ b/test/inspector/runtime/regression-736302-expected.txt
@@ -0,0 +1,82 @@
+crbug.com/736302
+
+Running test: testThrowException
+{
+    method : Runtime.consoleAPICalled
+    params : {
+        args : [
+            [0] : {
+                type : string
+                value : 1
+            }
+        ]
+        executionContextId : <executionContextId>
+        stackTrace : {
+            callFrames : [
+                [0] : {
+                    columnNumber : 12
+                    functionName : 
+                    lineNumber : 1
+                    scriptId : <scriptId>
+                    url : 
+                }
+            ]
+        }
+        timestamp : <timestamp>
+        type : count
+    }
+}
+
+Running test: testCustomName
+{
+    method : Runtime.consoleAPICalled
+    params : {
+        args : [
+            [0] : {
+                type : string
+                value : [object MyObject]: 1
+            }
+        ]
+        executionContextId : <executionContextId>
+        stackTrace : {
+            callFrames : [
+                [0] : {
+                    columnNumber : 12
+                    functionName : 
+                    lineNumber : 1
+                    scriptId : <scriptId>
+                    url : 
+                }
+            ]
+        }
+        timestamp : <timestamp>
+        type : count
+    }
+}
+
+Running test: testObject
+{
+    method : Runtime.consoleAPICalled
+    params : {
+        args : [
+            [0] : {
+                type : string
+                value : [object Object]: 1
+            }
+        ]
+        executionContextId : <executionContextId>
+        stackTrace : {
+            callFrames : [
+                [0] : {
+                    columnNumber : 12
+                    functionName : 
+                    lineNumber : 1
+                    scriptId : <scriptId>
+                    url : 
+                }
+            ]
+        }
+        timestamp : <timestamp>
+        type : count
+    }
+}
diff --git a/test/inspector/runtime/regression-736302.js b/test/inspector/runtime/regression-736302.js
new file mode 100644
index 0000000000..083e34af2d
--- /dev/null
+++ b/test/inspector/runtime/regression-736302.js
@@ -0,0 +1,40 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start('crbug.com/736302');
+
+InspectorTest.runAsyncTestSuite([
+  async function testThrowException() {
+    await Protocol.Runtime.enable();
+    Protocol.Runtime.evaluate({expression: `
+    console.count({
+      get [Symbol.toStringTag]() {
+        throw new Error();
+      }
+    });`});
+    InspectorTest.logMessage(await Protocol.Runtime.onceConsoleAPICalled());
+    await Protocol.Runtime.disable();
+  },
+
+  async function testCustomName() {
+    await Protocol.Runtime.enable();
+    Protocol.Runtime.evaluate({expression: `
+    console.count({
+      get [Symbol.toStringTag]() {
+        return 'MyObject';
+      }
+    });`});
+    InspectorTest.logMessage(await Protocol.Runtime.onceConsoleAPICalled());
+    await Protocol.Runtime.disable();
+  },
+
+  async function testObject() {
+    await Protocol.Runtime.enable();
+    Protocol.Runtime.evaluate({expression: `
+    console.count({});`});
+    InspectorTest.logMessage(await Protocol.Runtime.onceConsoleAPICalled());
+    await Protocol.Runtime.disable();
+  }
+
+]);