--- a/src/3rdparty/chromium/v8/src/objects/objects.cc +++ b/src/3rdparty/chromium/v8/src/objects/objects.cc @@ -2513,6 +2513,12 @@ Maybe Object::SetPropertyInternal(LookupIterator* it, Maybe result = JSObject::SetPropertyWithInterceptor(it, should_throw, value); if (result.IsNothing() || result.FromJust()) return result; + // Assuming that the callback have side effects, we use + // Object::SetSuperProperty() which works properly regardless on + // whether the property was present on the receiver or not when + // storing to the receiver. + // Proceed lookup from the next state. + it->Next(); } else { Maybe maybe_attributes = JSObject::GetPropertyAttributesWithInterceptor(it); @@ -2533,10 +2539,8 @@ Maybe Object::SetPropertyInternal(LookupIterator* it, // property to the receiver. it->NotFound(); } - return Object::SetSuperProperty(it, value, store_origin, - should_throw); } - break; + return Object::SetSuperProperty(it, value, store_origin, should_throw); } case LookupIterator::ACCESSOR: {