IndexedDB: Avoid side effects for array key conversion w/ HasOwnProperty

third_party/WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 195 matching lines @@
 
         if (stack.contains(array))
             return nullptr;
         if (stack.size() >= maximumDepth)
             return nullptr;
         stack.append(array);
 
         IDBKey::KeyArray subkeys;
         uint32_t length = array->Length();
         v8::TryCatch block(isolate);
+        v8::Local<v8::Context> context = isolate->GetCurrentContext();
         for (uint32_t i = 0; i < length; ++i) {
+            if (!v8CallBoolean(array->HasOwnProperty(context, i)))
+                return nullptr;
             v8::Local<v8::Value> item;
-            if (!v8Call(array->Get(isolate->GetCurrentContext(), i), item, block)) {
+            if (!v8Call(array->Get(context, i), item, block)) {
                 exceptionState.rethrowV8Exception(block.Exception());
                 return nullptr;
             }
             IDBKey* subkey = createIDBKeyFromValue(isolate, item, stack, exceptionState, allowExperimentalTypes);
             if (!subkey)
                 subkeys.append(IDBKey::createInvalid());
             else
                 subkeys.append(subkey);
         }
 
@@ skipping 389 matching lines @@
             V8NavigatorPartial::installWebBluetooth(scriptState, navigator);
         }
     }
 }
 
 void registerInstallOriginTrialsForModules()
 {
     s_originalInstallOriginTrialsFunction = setInstallOriginTrialsFunction(&installOriginTrialsForModules);
 }
 } // namespace blink