1 files changed, 40 insertions, 8 deletions
diff --git a/chromium/base/json/json_writer_unittest.cc b/chromium/base/json/json_writer_unittest.cc
index 291a225f6ff..81d8e3d4be8 100644
--- a/chromium/base/json/json_writer_unittest.cc
+++ b/chromium/base/json/json_writer_unittest.cc
@@ -61,9 +61,9 @@ TEST(JSONWriterTest, NestedTypes) {
   ListValue list;
   DictionaryValue inner_dict;
   inner_dict.SetIntKey("inner int", 10);
-  list.GetList().push_back(std::move(inner_dict));
-  list.GetList().emplace_back(Value::Type::LIST);
-  list.GetList().emplace_back(true);
+  list.Append(std::move(inner_dict));
+  list.Append(Value(Value::Type::LIST));
+  list.Append(true);
   root_dict.SetKey("list", std::move(list));
 
   // Test the pretty-printer.
@@ -121,11 +121,11 @@ TEST(JSONWriterTest, BinaryValues) {
   EXPECT_TRUE(output_js.empty());
 
   ListValue binary_list;
-  binary_list.GetList().emplace_back(kBufferSpan);
-  binary_list.GetList().emplace_back(5);
-  binary_list.GetList().emplace_back(kBufferSpan);
-  binary_list.GetList().emplace_back(2);
-  binary_list.GetList().emplace_back(kBufferSpan);
+  binary_list.Append(Value(kBufferSpan));
+  binary_list.Append(5);
+  binary_list.Append(Value(kBufferSpan));
+  binary_list.Append(2);
+  binary_list.Append(Value(kBufferSpan));
   EXPECT_FALSE(JSONWriter::Write(binary_list, &output_js));
   EXPECT_TRUE(JSONWriter::WriteWithOptions(
       binary_list, JSONWriter::OPTIONS_OMIT_BINARY_VALUES, &output_js));
@@ -154,4 +154,36 @@ TEST(JSONWriterTest, DoublesAsInts) {
   EXPECT_EQ("10000000000", output_js);
 }
 
+TEST(JSONWriterTest, StackOverflow) {
+  std::string output_js;
+  ListValue deep_list;
+  ListValue* next_list = &deep_list;
+
+  const size_t max_depth = 100000;
+
+  for (size_t i = 0; i < max_depth; ++i) {
+    ListValue inner_list;
+    next_list->Append(std::move(inner_list));
+    next_list->GetList(0, &next_list);
+  }
+
+  EXPECT_FALSE(JSONWriter::Write(deep_list, &output_js));
+  EXPECT_FALSE(JSONWriter::WriteWithOptions(
+      deep_list, JSONWriter::OPTIONS_PRETTY_PRINT, &output_js));
+
+  // We cannot just let deep_list tear down since it
+  // would cause a stack overflow. Therefore, we tear
+  // down from the inner lists outwards safely.
+  const size_t step = 200;
+  for (size_t i = max_depth - step; i > 0; i -= step) {
+    next_list = &deep_list;
+    for (size_t curr_depth = 0; curr_depth < i && next_list; ++curr_depth) {
+      if (!next_list->GetList(0, &next_list))
+        next_list = nullptr;
+    }
+    if (next_list)
+      next_list->Remove(0, nullptr);
+  }
+}
+
 }  // namespace base