IndexedDB: Avoid side effects by evaluating key paths w/ HasOwnProperty
Although key path evaluation is always done against clones (so getters
are flattened into simple data properties), property lookups were
not restricted to inherited properties, allowing getters on prototypes
to be executed. This allows evaluation to be observable, and cause
side effects.
Restrict the lookup to own properties, and introduce special-case code
for those non-own values identified in the spec[1] as special cases.
[1] https://w3c.github.io/IndexedDB/#key-path-construct
BUG=637963
R=haraken@chromium.org
Review-Url: https://codereview.chromium.org/2255413004
Cr-Commit-Position: refs/heads/master@{#414170}
3 files changed