From: Valentin Bartenev <vbart@nginx.com>
Date: Thu, 23 May 2019 12:05:52 +0000 (+0300)
Subject: Fixed overwriting "constructor" property of built-in prototypes.
X-Git-Url: http://git.kaiwu.me/postgresql/log/contrib/postgres_fdw/static/gitweb.js?a=commitdiff_plain;h=00eecd5f6c27fd7a31302c8fba7ca7a6564f7a8c;p=njs.git

Fixed overwriting "constructor" property of built-in prototypes.
---

diff --git a/njs/njs_object.c b/njs/njs_object.c
index 46b15cd4..0d2ef7c8 100644
--- a/njs/njs_object.c
+++ b/njs/njs_object.c
@@ -2909,8 +2909,11 @@ njs_object_prototype_create_constructor(njs_vm_t *vm, njs_value_t *value,
 
 found:
 
-    cons = njs_property_constructor_create(vm, &prototype->object.hash,
-                                          &vm->scopes[NJS_SCOPE_GLOBAL][index]);
+    if (setval == NULL) {
+        setval = &vm->scopes[NJS_SCOPE_GLOBAL][index];
+    }
+
+    cons = njs_property_constructor_create(vm, &prototype->object.hash, setval);
     if (nxt_fast_path(cons != NULL)) {
         *retval = *cons;
         return NXT_OK;
@@ -2943,7 +2946,7 @@ njs_property_constructor_create(njs_vm_t *vm, nxt_lvlhsh_t *hash,
     lhq.value = prop;
     lhq.key_hash = NJS_CONSTRUCTOR_HASH;
     lhq.key = nxt_string_value("constructor");
-    lhq.replace = 0;
+    lhq.replace = 1;
     lhq.pool = vm->mem_pool;
     lhq.proto = &njs_object_hash_proto;
 
@@ -2953,7 +2956,7 @@ njs_property_constructor_create(njs_vm_t *vm, nxt_lvlhsh_t *hash,
         return &prop->value;
     }
 
-    njs_internal_error(vm, "lvlhsh insert failed");
+    njs_internal_error(vm, "lvlhsh insert/replace failed");
 
     return NULL;
 }
diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index ecb873db..a6593a56 100644
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -8480,6 +8480,15 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("Boolean.prototype.constructor === Boolean"),
       nxt_string("true") },
 
+    { nxt_string("Boolean.prototype.constructor = 1;"
+                 "Boolean.prototype.constructor"),
+      nxt_string("1") },
+
+    { nxt_string("var c = Boolean.prototype.constructor;"
+                 "Boolean.prototype.constructor = 1;"
+                 "[c(0), Boolean.prototype.constructor]"),
+      nxt_string("false,1") },
+
     { nxt_string("Boolean.prototype.hasOwnProperty('constructor')"),
       nxt_string("true") },