add fix for CVE-2022-1096; rel 4

[packages/qt5-qtwebengine.git] / CVE-2022-1096-qtwebengine-5.15.diff

--- a/src/3rdparty/chromium/v8/src/objects/objects.cc\r
+++ b/src/3rdparty/chromium/v8/src/objects/objects.cc\r
@@ -2481,6 +2481,12 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,\r
           Maybe<bool> result =\r
               JSObject::SetPropertyWithInterceptor(it, should_throw, value);\r
           if (result.IsNothing() || result.FromJust()) return result;\r
+          // Assuming that the callback have side effects, we use\r
+          // Object::SetSuperProperty() which works properly regardless on\r
+          // whether the property was present on the receiver or not when\r
+          // storing to the receiver.\r
+          // Proceed lookup from the next state.\r
+          it->Next();\r
         } else {\r
           Maybe<PropertyAttributes> maybe_attributes =\r
               JSObject::GetPropertyAttributesWithInterceptor(it);\r
@@ -2501,10 +2507,8 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,\r
             // property to the receiver.\r
             it->NotFound();\r
           }\r
-          return Object::SetSuperProperty(it, value, store_origin,\r
-                                          should_throw);\r
         }\r
-        break;\r
+        return Object::SetSuperProperty(it, value, store_origin, should_throw);\r
       }\r
\r
       case LookupIterator::ACCESSOR: {\r