8030197: Nashorn: Object.defineProperty() can be lured to change fixed NaN property
authorsundar
Tue, 25 Feb 2014 18:56:10 +0530
changeset 23083 8c74590d5df1
parent 23081 cb11df1000a7
child 23084 6c5c02d1023a
child 23370 590e38c19723
child 24719 f726e9d67629
8030197: Nashorn: Object.defineProperty() can be lured to change fixed NaN property Reviewed-by: attila, jlaskey
nashorn/src/jdk/nashorn/internal/objects/AccessorPropertyDescriptor.java
nashorn/src/jdk/nashorn/internal/objects/DataPropertyDescriptor.java
nashorn/src/jdk/nashorn/internal/objects/GenericPropertyDescriptor.java
nashorn/src/jdk/nashorn/internal/runtime/PropertyDescriptor.java
nashorn/src/jdk/nashorn/internal/runtime/ScriptObject.java
nashorn/test/script/basic/JDK-8030197.js
--- a/nashorn/src/jdk/nashorn/internal/objects/AccessorPropertyDescriptor.java	Thu Feb 20 20:00:48 2014 -0800
+++ b/nashorn/src/jdk/nashorn/internal/objects/AccessorPropertyDescriptor.java	Tue Feb 25 18:56:10 2014 +0530
@@ -185,6 +185,18 @@
     }
 
     @Override
+    public boolean hasAndEquals(final PropertyDescriptor otherDesc) {
+        if (! (otherDesc instanceof AccessorPropertyDescriptor)) {
+            return false;
+        }
+        final AccessorPropertyDescriptor other = (AccessorPropertyDescriptor)otherDesc;
+        return (!has(CONFIGURABLE) || sameValue(configurable, other.configurable)) &&
+               (!has(ENUMERABLE) || sameValue(enumerable, other.enumerable)) &&
+               (!has(GET) || sameValue(get, other.get)) &&
+               (!has(SET) || sameValue(set, other.set));
+    }
+
+    @Override
     public boolean equals(final Object obj) {
         if (this == obj) {
             return true;
--- a/nashorn/src/jdk/nashorn/internal/objects/DataPropertyDescriptor.java	Thu Feb 20 20:00:48 2014 -0800
+++ b/nashorn/src/jdk/nashorn/internal/objects/DataPropertyDescriptor.java	Tue Feb 25 18:56:10 2014 +0530
@@ -172,6 +172,19 @@
     }
 
     @Override
+    public boolean hasAndEquals(final PropertyDescriptor otherDesc) {
+        if (! (otherDesc instanceof DataPropertyDescriptor)) {
+            return false;
+        }
+
+        final DataPropertyDescriptor other = (DataPropertyDescriptor)otherDesc;
+        return (!has(CONFIGURABLE) || sameValue(configurable, other.configurable)) &&
+               (!has(ENUMERABLE) || sameValue(enumerable, other.enumerable)) &&
+               (!has(WRITABLE) || sameValue(writable, other.writable)) &&
+               (!has(VALUE) || sameValue(value, other.value));
+    }
+
+    @Override
     public boolean equals(final Object obj) {
         if (this == obj) {
             return true;
--- a/nashorn/src/jdk/nashorn/internal/objects/GenericPropertyDescriptor.java	Thu Feb 20 20:00:48 2014 -0800
+++ b/nashorn/src/jdk/nashorn/internal/objects/GenericPropertyDescriptor.java	Tue Feb 25 18:56:10 2014 +0530
@@ -149,6 +149,23 @@
     }
 
     @Override
+    public boolean hasAndEquals(final PropertyDescriptor other) {
+        if (has(CONFIGURABLE) && other.has(CONFIGURABLE)) {
+            if (isConfigurable() != other.isConfigurable()) {
+                return false;
+            }
+        }
+
+        if (has(ENUMERABLE) && other.has(ENUMERABLE)) {
+            if (isEnumerable() != other.isEnumerable()) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    @Override
     public boolean equals(final Object obj) {
         if (this == obj) {
             return true;
--- a/nashorn/src/jdk/nashorn/internal/runtime/PropertyDescriptor.java	Thu Feb 20 20:00:48 2014 -0800
+++ b/nashorn/src/jdk/nashorn/internal/runtime/PropertyDescriptor.java	Tue Feb 25 18:56:10 2014 +0530
@@ -151,5 +151,12 @@
      * @return true if property exists in implementor
      */
     public boolean has(Object key);
+
+    /**
+     * Check existence and compare attributes of descriptors.
+     *
+     * @return true if every field of this desc exists in otherDesc and has the same value.
+     */
+    public boolean hasAndEquals(PropertyDescriptor otherDesc);
 }
 
--- a/nashorn/src/jdk/nashorn/internal/runtime/ScriptObject.java	Thu Feb 20 20:00:48 2014 -0800
+++ b/nashorn/src/jdk/nashorn/internal/runtime/ScriptObject.java	Tue Feb 25 18:56:10 2014 +0530
@@ -469,7 +469,7 @@
             return true;
         }
 
-        if (currentDesc.equals(newDesc)) {
+        if (newDesc.hasAndEquals(currentDesc)) {
             // every descriptor field of the new is same as the current
             return true;
         }
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/nashorn/test/script/basic/JDK-8030197.js	Tue Feb 25 18:56:10 2014 +0530
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * 
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ * 
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ * 
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * 
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+/**
+ * JDK-8030197: Nashorn: Object.defineProperty() can be lured to change fixed NaN property
+ *
+ * @test
+ * @run
+ */
+
+function str(n) {
+    var a = new Uint8Array(new Float64Array([n]).buffer);
+    return Array.apply(null, a).reduceRight(
+        function(acc, v){
+            return acc + (v < 10 ? "0" : "") + v.toString(16);
+        }, "");
+}
+
+var o = Object.defineProperty({}, "NaN", { value: NaN })
+var str1 = str(o.NaN);
+Object.defineProperty(o, "NaN", { value: 0/0 })
+var str2 = str(o.NaN);
+if (str1 != str2) {
+    fail("NaN bit pattern changed");
+}