Don't call SetProperty on the plugin unless HasProperty is true

content/renderer/pepper/plugin_object.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/plugin_object.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 79 matching lines @@
 
 bool PluginObject::SetNamedProperty(v8::Isolate* isolate,
                                     const std::string& identifier,
                                     v8::Local<v8::Value> value) {
   if (!instance_)
     return false;
   ScopedPPVar identifier_var(ScopedPPVar::PassRef(),
                              StringVar::StringToPPVar(identifier));
   PepperTryCatchV8 try_catch(instance_, V8VarConverter::kAllowObjectVars,
                              isolate);
+
+  bool has_property =
+      ppp_class_->HasProperty(ppp_class_data_, identifier_var.get(),
+                              try_catch.exception());
+  if (try_catch.ThrowException())
+    return false;
+
+  if (!has_property)
+    return false;
+
   ScopedPPVar var = try_catch.FromV8(value);
   if (try_catch.ThrowException())
     return false;
 
   ppp_class_->SetProperty(ppp_class_data_, identifier_var.get(), var.get(),
                           try_catch.exception());
 
   // If the plugin threw an exception, then throw a V8 version of it to
   // JavaScript. Either way, return true, because we successfully dispatched
   // the call to the plugin.
@@ skipping 136 matching lines @@
     return;
 
   v8::Handle<v8::Value> result = try_catch.ToV8(result_var.get());
   if (try_catch.ThrowException())
     return;
 
   args->Return(result);
 }
 
 }  // namespace content