IndexedDB: Avoid side effects by evaluating key paths w/ HasOwnProperty

third_party/WebKit/LayoutTests/storage/indexeddb/key_conversion_exceptions.html

Index: third_party/WebKit/LayoutTests/storage/indexeddb/key_conversion_exceptions.html
diff --git a/third_party/WebKit/LayoutTests/storage/indexeddb/key_conversion_exceptions.html b/third_party/WebKit/LayoutTests/storage/indexeddb/key_conversion_exceptions.html
index 9bfd6aaff647c4f854b1e0bb328d08629afb0fe5..23ed89be9955e6a222933918f20a323f1d8a7b53 100644
--- a/third_party/WebKit/LayoutTests/storage/indexeddb/key_conversion_exceptions.html
+++ b/third_party/WebKit/LayoutTests/storage/indexeddb/key_conversion_exceptions.html
@@ -29,7 +29,7 @@ function throwing_key(name) {
         var err = new Error('throwing from getter');
         err.name = name;
         throw err;
-    }});
+    }, enumerable: true});
     return throws;
 }
 
@@ -115,16 +115,18 @@ simple_idb_test(function(t, db) {
         var cursor = request.result;
         assert_not_equals(cursor, null, 'cursor should find a value');
 
-        // Put property on prototype because the keypath is
-        // evaluated against a structured clone, not the passed value.
         var value = {};
-
-        value.__proto__.prop = throwing_key('getter');
-        assert_throws({name:'getter'}, function() {
+        value.prop = throwing_key('getter');
+        assert_throws({name: 'getter'}, function() {
             cursor.update(value);
-        }, 'key conversion with throwing getter should rethrow');
+        }, 'throwing getter should rethrow during clone');
+
+        // Throwing from the getter during key conversion is
+        // not possible since (1) a clone is used, (2) only own
+        // properties are cloned, and (3) only own properties
+        // are used for key path evaluation.
 
-        value.__proto__.prop = invalid_key;
+        value.prop = invalid_key;
         assert_throws('DataError', function() {
             cursor.update(value);
         }, 'key conversion with invalid key should throw DataError');
@@ -156,16 +158,18 @@ test(function(t) {
             out_of_line[method]('value', invalid_key);
         }, 'key conversion with invalid key should throw DataError');
 
-        // Put property on prototype because the keypath is
-        // evaluated against a structured clone, not the passed value.
         var value = {};
-
-        value.__proto__.prop = throwing_key('getter');
+        value.prop = throwing_key('getter');
         assert_throws({name:'getter'}, function() {
             in_line[method](value);
-        }, 'key conversion with throwing getter should rethrow');
+        }, 'throwing getter should rethrow during clone');
+
+        // Throwing from the getter during key conversion is
+        // not possible since (1) a clone is used, (2) only own
+        // properties are cloned, and (3) only own properties
+        // are used for key path evaluation.
 
-        value.__proto__.prop = invalid_key;
+        value.prop = invalid_key;
         assert_throws('DataError', function() {
             in_line[method](value);
         }, 'key conversion with invalid key should throw DataError');