IDB WPTs: Run bindings-inject-keys/bindings-inject-values on workers

Currently, the bindings-inject-keys-bypass-* and
bindings-inject-values-bypass-* IndexedDB WPTs only run in a window
environment.This change extends them to also run in dedicated, shared,
and service worker environments.

Bug: 41455766
Change-Id: I8ee7daf2ee8a86de9482eba7690de06f12dfae1d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5567651
Reviewed-by: Evan Stade <estade@chromium.org>
Commit-Queue: Rahul Singh <rahsin@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1307123}

IndexedDB/bindings-inject-keys-bypass.any.js

@@ -0,0 +1,29 @@
+// META: global=window,worker
+// META: title=IndexedDB: ES bindings - Inject a key into a value - Keys bypass setters
+// META: script=resources/support-promises.js
+
+'use_strict';
+
+promise_test(async t => {
+  const db = await createDatabase(t, db => {
+    db.createObjectStore('store');
+  });
+
+  let setter_called = false;
+  Object.defineProperty(Object.prototype, '10', {
+    configurable: true,
+    set: value => { setter_called = true; },
+  });
+  t.add_cleanup(() => { delete Object.prototype['10']; });
+
+  const tx = db.transaction('store', 'readwrite', { durability: 'relaxed' });
+  const result = await promiseForRequest(t, tx.objectStore('store').put(
+    'value', [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 'key']));
+
+  assert_false(setter_called,
+    'Setter should not be called for key result.');
+  assert_true(result.hasOwnProperty('10'),
+    'Result should have own-property overriding prototype setter.');
+  assert_equals(result[10], 'key',
+    'Result should have expected property.');
+}, 'Returning keys to script should bypass prototype setters');

IndexedDB/bindings-inject-values-bypass.any.js

@@ -0,0 +1,53 @@
+// META: global=window,worker
+// META: title=IndexedDB: ES bindings - Inject a key into a value - Values bypass chain and setters
+// META: script=resources/support-promises.js
+
+'use_strict';
+
+promise_test(async t => {
+  const db = await createDatabase(t, db => {
+    db.createObjectStore('store', {autoIncrement: true, keyPath: 'a.b.c'});
+  });
+
+  Object.prototype.a = {b: {c: 'on proto'}};
+  t.add_cleanup(() => { delete Object.prototype.a; });
+
+  const tx = db.transaction('store', 'readwrite', {durability: "relaxed"});
+  tx.objectStore('store').put({});
+  const result = await promiseForRequest(t, tx.objectStore('store').get(1));
+
+  assert_true(result.hasOwnProperty('a'),
+              'Result should have own-properties overriding prototype.');
+  assert_true(result.a.hasOwnProperty('b'),
+              'Result should have own-properties overriding prototype.');
+  assert_true(result.a.b.hasOwnProperty('c'),
+              'Result should have own-properties overriding prototype.');
+  assert_equals(result.a.b.c, 1,
+                'Own property should match primary key generator value');
+  assert_equals(Object.prototype.a.b.c, 'on proto',
+                'Prototype should not be modified');
+}, 'Returning values to script should bypass prototype chain');
+
+promise_test(async t => {
+  const db = await createDatabase(t, db => {
+    db.createObjectStore('store', {autoIncrement: true, keyPath: 'id'});
+  });
+
+  let setter_called = false;
+  Object.defineProperty(Object.prototype, 'id', {
+    configurable: true,
+    set: value => { setter_called = true; },
+  });
+  t.add_cleanup(() => { delete Object.prototype['id']; });
+
+  const tx = db.transaction('store', 'readwrite', {durability: 'relaxed'});
+  tx.objectStore('store').put({});
+  const result = await promiseForRequest(t, tx.objectStore('store').get(1));
+
+  assert_false(setter_called,
+               'Setter should not be called for key result.');
+  assert_true(result.hasOwnProperty('id'),
+              'Result should have own-property overriding prototype setter.');
+  assert_equals(result.id, 1,
+                'Own property should match primary key generator value');
+}, 'Returning values to script should bypass prototype setters');