Better handle non-existant wrappers when intercepting writes to plugin objects

Creating a wrapper might fire events synchronously which in turn can
modify the wrapper. There is, however, an invariant for interceptors
that if they modify their holder, they need to signal this. Therefore,
when we create a wrapper, always signal that the write happened.

BUG=670155
R=tkent@chromium.org,haraken@chromium.org

Review-Url: https://codereview.chromium.org/2566663002
Cr-Commit-Position: refs/heads/master@{#439812}

third_party/WebKit/LayoutTests/imported/wpt/html/dom/reflection-embedded-expected.txt

@@ -89,20 +89,20 @@ FAIL object.typeMustMatch: setAttribute() to object "test-toString" assert_equal
 FAIL object.typeMustMatch: setAttribute() to object "test-valueOf" assert_equals: IDL get expected (boolean) true but got (undefined) undefined
 FAIL object.typeMustMatch: setAttribute() to "typeMustMatch" assert_equals: IDL get expected (boolean) true but got (undefined) undefined
 FAIL object.typeMustMatch: IDL set to "" assert_equals: hasAttribute() expected false but got true
-FAIL object.typeMustMatch: IDL set to " foo " assert_equals: IDL get expected (boolean) true but got (string) " foo "
+FAIL object.typeMustMatch: IDL set to " foo " assert_equals: IDL get expected (boolean) true but got (undefined) undefined
 FAIL object.typeMustMatch: IDL set to undefined assert_equals: hasAttribute() expected false but got true
 FAIL object.typeMustMatch: IDL set to null assert_equals: hasAttribute() expected false but got true
-FAIL object.typeMustMatch: IDL set to 7 assert_equals: IDL get expected (boolean) true but got (number) 7
-FAIL object.typeMustMatch: IDL set to 1.5 assert_equals: IDL get expected (boolean) true but got (number) 1.5
-PASS object.typeMustMatch: IDL set to true 
+FAIL object.typeMustMatch: IDL set to 7 assert_equals: IDL get expected (boolean) true but got (undefined) undefined
+FAIL object.typeMustMatch: IDL set to 1.5 assert_equals: IDL get expected (boolean) true but got (undefined) undefined
+FAIL object.typeMustMatch: IDL set to true assert_equals: IDL get expected (boolean) true but got (undefined) undefined
 FAIL object.typeMustMatch: IDL set to false assert_equals: hasAttribute() expected false but got true
-FAIL object.typeMustMatch: IDL set to object "[object Object]" assert_equals: IDL get expected (boolean) true but got (object) object "[object Object]"
+FAIL object.typeMustMatch: IDL set to object "[object Object]" assert_equals: IDL get expected (boolean) true but got (undefined) undefined
 FAIL object.typeMustMatch: IDL set to NaN assert_equals: hasAttribute() expected false but got true
-FAIL object.typeMustMatch: IDL set to Infinity assert_equals: IDL get expected (boolean) true but got (number) Infinity
-FAIL object.typeMustMatch: IDL set to -Infinity assert_equals: IDL get expected (boolean) true but got (number) -Infinity
-FAIL object.typeMustMatch: IDL set to "\0" assert_equals: IDL get expected (boolean) true but got (string) "\0"
-FAIL object.typeMustMatch: IDL set to object "test-toString" assert_equals: IDL get expected (boolean) true but got (object) object "test-toString"
-FAIL object.typeMustMatch: IDL set to object "test-valueOf" assert_equals: IDL get expected (boolean) true but got (object) object "test-valueOf"
+FAIL object.typeMustMatch: IDL set to Infinity assert_equals: IDL get expected (boolean) true but got (undefined) undefined
+FAIL object.typeMustMatch: IDL set to -Infinity assert_equals: IDL get expected (boolean) true but got (undefined) undefined
+FAIL object.typeMustMatch: IDL set to "\0" assert_equals: IDL get expected (boolean) true but got (undefined) undefined
+FAIL object.typeMustMatch: IDL set to object "test-toString" assert_equals: IDL get expected (boolean) true but got (undefined) undefined
+FAIL object.typeMustMatch: IDL set to object "test-valueOf" assert_equals: IDL get expected (boolean) true but got (undefined) undefined
 PASS object.name: 32 tests
 PASS object.useMap: 32 tests
 PASS object.width: 32 tests

third_party/WebKit/LayoutTests/plugins/reattach-plugin-during-access-expected.txt

+
+Test passes if it doesn't crash

third_party/WebKit/LayoutTests/plugins/reattach-plugin-during-access.html

+<!DOCTYPE html>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+
+function f() {
+  divElem.appendChild(objElem);
+  objElem[''] = 42;
+}
+</script>
+<div id='divElem'></div>
+<object id='objElem' type="text/javascript" onload='f()'></object>
+<p>Test passes if it doesn't crash</p>

third_party/WebKit/Source/bindings/core/v8/custom/V8HTMLPlugInElementCustom.cpp

@@ -74,21 +74,18 @@ void setScriptableObjectProperty(
     v8::Local<v8::Value> value,
     const v8::PropertyCallbackInfo<v8::Value>& info) {
   ASSERT(!value.IsEmpty());
-  HTMLPlugInElement* impl = ElementType::toImpl(info.Holder());
-  RefPtr<SharedPersistent<v8::Object>> wrapper = impl->pluginWrapper();
-  if (!wrapper)
-    return;
-
-  v8::Local<v8::Object> instance = wrapper->newLocal(info.GetIsolate());
-  if (instance.IsEmpty())
-    return;
-
   // Don't intercept any of the properties of the HTMLPluginElement.
   v8::Local<v8::String> v8Name = v8String(info.GetIsolate(), name);
   if (v8CallBoolean(
           info.Holder()->Has(info.GetIsolate()->GetCurrentContext(), v8Name)))
     return;
 
+  HTMLPlugInElement* impl = ElementType::toImpl(info.Holder());
+  RefPtr<SharedPersistent<v8::Object>> wrapper = impl->pluginWrapper();
+  v8::Local<v8::Object> instance;
+  if (wrapper)
+    instance = wrapper->newLocal(info.GetIsolate());
+  if (!instance.IsEmpty()) {
     // FIXME: The gTalk pepper plugin is the only plugin to make use of
     // SetProperty and that is being deprecated. This can be removed as soon as
     // it goes away.
@@ -100,6 +97,7 @@ void setScriptableObjectProperty(
     // that the property on the DOM element also gets set is inconsequential.
     v8CallBoolean(instance->CreateDataProperty(
         info.GetIsolate()->GetCurrentContext(), v8Name, value));
+  }
   v8SetReturnValue(info, value);
 }