Only access a plugin's scriptable object, and not also its prototype chain

third_party/WebKit/Source/bindings/core/v8/custom/V8HTMLPlugInElementCustom.cpp

 /*
 * Copyright (C) 2009 Google Inc. All rights reserved.
 * Copyright (C) 2014 Opera Software ASA. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 *     * Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
@@ skipping 35 matching lines @@
 {
     HTMLPlugInElement* impl = ElementType::toImpl(info.Holder());
     RefPtr<SharedPersistent<v8::Object>> wrapper = impl->pluginWrapper();
     if (!wrapper)
         return;
 
     v8::Local<v8::Object> instance = wrapper->newLocal(info.GetIsolate());
     if (instance.IsEmpty())
         return;
 
+    if (!v8CallBoolean(instance->HasOwnProperty(info.GetIsolate()->GetCurrentContext(), property)))
+        return;
+
     v8::Local<v8::Value> value;
     if (!instance->Get(info.GetIsolate()->GetCurrentContext(), property).ToLocal(&value))
         return;
 
-    // We quit here to allow the binding code to look up general HTMLObjectElement properties
-    // if they are not overriden by plugin.
-    if (value->IsUndefined() && !v8CallBoolean(instance->Has(info.GetIsolate()->GetCurrentContext(), property)))
-        return;
-
     v8SetReturnValue(info, value);
 }
 
 template <typename ElementType, typename PropertyType>
 void setScriptableObjectProperty(PropertyType property, v8::Local<v8::Value> value, const v8::PropertyCallbackInfo<v8::Value>& info)
 {
     ASSERT(!value.IsEmpty());
     HTMLPlugInElement* impl = ElementType::toImpl(info.Holder());
     RefPtr<SharedPersistent<v8::Object>> wrapper = impl->pluginWrapper();
     if (!wrapper)
         return;
 
     v8::Local<v8::Object> instance = wrapper->newLocal(info.GetIsolate());
     if (instance.IsEmpty())
         return;
 
     // FIXME: The gTalk pepper plugin is the only plugin to make use of
     // SetProperty and that is being deprecated. This can be removed as soon as
     // it goes away.
     // Call SetProperty on a pepper plugin's scriptable object. Note that we
     // never set the return value here which would indicate that the plugin has
     // intercepted the SetProperty call, which means that the property on the
     // DOM element will also be set. For plugin's that don't intercept the call
     // (all except gTalk) this makes no difference at all. For gTalk the fact
     // that the property on the DOM element also gets set is inconsequential.
-    v8::Maybe<bool> unused = instance->Set(info.GetIsolate()->GetCurrentContext(), property, value);
-    ALLOW_UNUSED_LOCAL(unused);
+    v8CallBoolean(instance->CreateDataProperty(info.GetIsolate()->GetCurrentContext(), property, value));
 }
 } // namespace
 
 void V8HTMLEmbedElement::namedPropertyGetterCustom(v8::Local<v8::Name> name, const v8::PropertyCallbackInfo<v8::Value>& info)
 {
     getScriptableObjectProperty<V8HTMLEmbedElement>(name.As<v8::String>(), info);
 }
 
 void V8HTMLObjectElement::namedPropertyGetterCustom(v8::Local<v8::Name> name, const v8::PropertyCallbackInfo<v8::Value>& info)
 {
@@ skipping 62 matching lines @@
     UseCounter::countIfNotPrivateScript(info.GetIsolate(), V8HTMLEmbedElement::toImpl(info.Holder())->document(), UseCounter::HTMLEmbedElementLegacyCall);
 }
 
 void V8HTMLObjectElement::legacyCallCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     invokeOnScriptableObject<V8HTMLObjectElement>(info);
     UseCounter::countIfNotPrivateScript(info.GetIsolate(), V8HTMLObjectElement::toImpl(info.Holder())->document(), UseCounter::HTMLObjectElementLegacyCall);
 }
 
 } // namespace blink