IndexedDB: Avoid side effects by evaluating key paths w/ HasOwnProperty

IndexedDB: Avoid side effects by evaluating key paths w/ HasOwnProperty

Although key path evaluation is always done against clones (so getters
are flattened into simple data properties), property lookups were
not restricted to inherited properties, allowing getters on prototypes
to be executed. This allows evaluation to be observable, and cause
side effects.

Restrict the lookup to own properties, and introduce special-case code
for those non-own values identified in the spec[1] as special cases.

[1] https://w3c.github.io/IndexedDB/#key-path-construct

BUG=637963
R=haraken@chromium.org

Committed: https://crrev.com/fb18204c77e3f6e43ce05dd3ce24f00e0201bac1
Cr-Commit-Position: refs/heads/master@{#414170}

[jsbell, 2016-08-19 21:39:26]

haraken@ - can you please take a look?

See the bug for more context about this change.

Note that the Indexed DB spec does explicitly use [[Get]] without a
HasOwnProperty() check but I wrote that during the last round of "hrm, there are
some bad edge cases here". I'll introduce a spec fix. 

https://w3c.github.io/IndexedDB/#extract-key-from-value

Behavior in other browsers is already inconsistent here. Similar bugs in them
wouldn't surprise me.

[haraken, 2016-08-22 05:01:24]

LGTM

[jsbell, 2016-08-24 16:19:41]

Description was changed from

==========
IndexedDB: Avoid side effects by evaluating key paths w/ HasOwnProperty

Although key path evaluation is always done against clones (so getters
are flattened into simple data properties), property lookups were
not restricted to inherited properties, allowing getters on prototypes
to be executed. This allows evaluation to be observable, and cause
side effects.

Restrict the lookup to own properties, and introduce special-case code
for those non-own values identified in the spec[1] as special cases.

[1] https://w3c.github.io/IndexedDB/#key-path-construct

BUG=637963
R=haraken@chromium.org
==========

to

==========
IndexedDB: Avoid side effects by evaluating key paths w/ HasOwnProperty

Although key path evaluation is always done against clones (so getters
are flattened into simple data properties), property lookups were
not restricted to inherited properties, allowing getters on prototypes
to be executed. This allows evaluation to be observable, and cause
side effects.

Restrict the lookup to own properties, and introduce special-case code
for those non-own values identified in the spec[1] as special cases.

[1] https://w3c.github.io/IndexedDB/#key-path-construct

BUG=637963
R=haraken@chromium.org
==========

[jsbell, 2016-08-24 16:19:45]

The CQ bit was checked by jsbell@chromium.org

[commit-bot: I haz the power, 2016-08-24 16:20:27]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-24 18:18:04]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-24 18:18:06]

Try jobs failed on following builders:
  win_chromium_rel_ng on master.tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_...)

[jsbell, 2016-08-24 18:41:27]

The CQ bit was checked by jsbell@chromium.org

[commit-bot: I haz the power, 2016-08-24 18:42:01]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-24 22:18:32]

Description was changed from

==========
IndexedDB: Avoid side effects by evaluating key paths w/ HasOwnProperty

Although key path evaluation is always done against clones (so getters
are flattened into simple data properties), property lookups were
not restricted to inherited properties, allowing getters on prototypes
to be executed. This allows evaluation to be observable, and cause
side effects.

Restrict the lookup to own properties, and introduce special-case code
for those non-own values identified in the spec[1] as special cases.

[1] https://w3c.github.io/IndexedDB/#key-path-construct

BUG=637963
R=haraken@chromium.org
==========

to

==========
IndexedDB: Avoid side effects by evaluating key paths w/ HasOwnProperty

Although key path evaluation is always done against clones (so getters
are flattened into simple data properties), property lookups were
not restricted to inherited properties, allowing getters on prototypes
to be executed. This allows evaluation to be observable, and cause
side effects.

Restrict the lookup to own properties, and introduce special-case code
for those non-own values identified in the spec[1] as special cases.

[1] https://w3c.github.io/IndexedDB/#key-path-construct

BUG=637963
R=haraken@chromium.org
==========

[commit-bot: I haz the power, 2016-08-24 22:18:33]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-08-24 22:20:27]

Description was changed from

==========
IndexedDB: Avoid side effects by evaluating key paths w/ HasOwnProperty

Although key path evaluation is always done against clones (so getters
are flattened into simple data properties), property lookups were
not restricted to inherited properties, allowing getters on prototypes
to be executed. This allows evaluation to be observable, and cause
side effects.

Restrict the lookup to own properties, and introduce special-case code
for those non-own values identified in the spec[1] as special cases.

[1] https://w3c.github.io/IndexedDB/#key-path-construct

BUG=637963
R=haraken@chromium.org
==========

to

==========
IndexedDB: Avoid side effects by evaluating key paths w/ HasOwnProperty

Although key path evaluation is always done against clones (so getters
are flattened into simple data properties), property lookups were
not restricted to inherited properties, allowing getters on prototypes
to be executed. This allows evaluation to be observable, and cause
side effects.

Restrict the lookup to own properties, and introduce special-case code
for those non-own values identified in the spec[1] as special cases.

[1] https://w3c.github.io/IndexedDB/#key-path-construct

BUG=637963
R=haraken@chromium.org

Committed: https://crrev.com/fb18204c77e3f6e43ce05dd3ce24f00e0201bac1
Cr-Commit-Position: refs/heads/master@{#414170}
==========

[commit-bot: I haz the power, 2016-08-24 22:20:28]

Patchset 1 (id:??) landed as
https://crrev.com/fb18204c77e3f6e43ce05dd3ce24f00e0201bac1
Cr-Commit-Position: refs/heads/master@{#414170}