CVE-2022-1096-qtwebengine-5.15.diff

   1 --- a/src/3rdparty/chromium/v8/src/objects/objects.cc\r
   2 +++ b/src/3rdparty/chromium/v8/src/objects/objects.cc\r
   3 @@ -2481,6 +2481,12 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,\r
   4            Maybe<bool> result =\r
   5                JSObject::SetPropertyWithInterceptor(it, should_throw, value);\r
   6            if (result.IsNothing() || result.FromJust()) return result;\r
   7 +          // Assuming that the callback have side effects, we use\r
   8 +          // Object::SetSuperProperty() which works properly regardless on\r
   9 +          // whether the property was present on the receiver or not when\r
  10 +          // storing to the receiver.\r
  11 +          // Proceed lookup from the next state.\r
  12 +          it->Next();\r
  13          } else {\r
  14            Maybe<PropertyAttributes> maybe_attributes =\r
  15                JSObject::GetPropertyAttributesWithInterceptor(it);\r
  16 @@ -2501,10 +2507,8 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,\r
  17              // property to the receiver.\r
  18              it->NotFound();\r
  19            }\r
  20 -          return Object::SetSuperProperty(it, value, store_origin,\r
  21 -                                          should_throw);\r
  22          }\r
  23 -        break;\r
  24 +        return Object::SetSuperProperty(it, value, store_origin, should_throw);\r
  25        }\r
  26 \r
  27        case LookupIterator::ACCESSOR: {\r