From c3cf421a5bb9339f214852435e2060e3e8c13a72 Mon Sep 17 00:00:00 2001
From: sammc <sammc@chromium.org>
Date: Mon, 1 Dec 2014 15:44:26 -0800
Subject: [PATCH] Identify ArrayBuffers by their string representation in
 json_schema.js.

Previously, ArrayBuffers were identified by comparing their constructor
to the current context's ArrayBuffer constructor. This caused
ArrayBuffers from other contexts to be identified as "object" instead of
"binary".

BUG=389016

Review URL: https://codereview.chromium.org/684403002

Cr-Commit-Position: refs/heads/master@{#306294}
---
 extensions/renderer/json_schema_unittest.cc  | 13 +++++++++++++
 extensions/renderer/resources/json_schema.js |  4 ++--
 extensions/test/data/json_schema_test.js     |  2 ++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/extensions/renderer/json_schema_unittest.cc b/extensions/renderer/json_schema_unittest.cc
index 920616bf57c3..41a4b7114272 100644
--- a/extensions/renderer/json_schema_unittest.cc
+++ b/extensions/renderer/json_schema_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "extensions/renderer/module_system_test.h"
 #include "extensions/renderer/v8_schema_registry.h"
+#include "gin/dictionary.h"
 #include "grit/extensions_renderer_resources.h"
 
 namespace extensions {
@@ -72,6 +73,18 @@ TEST_F(JsonSchemaTest, TestIntegerBounds) {
 }
 
 TEST_F(JsonSchemaTest, TestType) {
+  gin::Dictionary array_buffer_container(
+      env()->isolate(),
+      env()->CreateGlobal("otherContextArrayBufferContainer"));
+  {
+    // Create an ArrayBuffer in another v8 context and pass it to the test
+    // through a global.
+    scoped_ptr<ModuleSystemTestEnvironment> other_env(CreateEnvironment());
+    v8::Context::Scope scope(other_env->context()->v8_context());
+    v8::Handle<v8::ArrayBuffer> array_buffer(
+        v8::ArrayBuffer::New(env()->isolate(), 1));
+    array_buffer_container.Set("value", array_buffer);
+  }
   TestFunction("testType");
 }
 
diff --git a/extensions/renderer/resources/json_schema.js b/extensions/renderer/resources/json_schema.js
index 67c30c9ac0cb..147dd67d636b 100644
--- a/extensions/renderer/resources/json_schema.js
+++ b/extensions/renderer/resources/json_schema.js
@@ -132,8 +132,8 @@ JSONSchemaValidator.getType = function(value) {
       return "null";
     } else if (Object.prototype.toString.call(value) == "[object Array]") {
       return "array";
-    } else if (typeof(ArrayBuffer) != "undefined" &&
-               value.constructor == ArrayBuffer) {
+    } else if (Object.prototype.toString.call(value) ==
+               "[object ArrayBuffer]") {
       return "binary";
     }
   } else if (s == "number") {
diff --git a/extensions/test/data/json_schema_test.js b/extensions/test/data/json_schema_test.js
index 645fd9de98ca..03fc05712249 100644
--- a/extensions/test/data/json_schema_test.js
+++ b/extensions/test/data/json_schema_test.js
@@ -443,6 +443,8 @@ function testType() {
   assertValid("Type", false, {type:"boolean"});
   assertValid("Type", null, {type:"null"});
   assertValid("Type", undefined, {type:"undefined"});
+  assertValid("Type", new ArrayBuffer(1), {type:"binary"});
+  assertValid("Type", otherContextArrayBufferContainer.value, {type:"binary"});
 
   // not valid
   assertNotValid("Type", [], {type: "object"},