8030197: Nashorn: Object.defineProperty() can be lured to change fixed NaN property

Reviewed-by: attila, jlaskey

5 files changed, 50 insertions, 1 deletions

diff --git a/src/jdk/nashorn/internal/objects/AccessorPropertyDescriptor.java b/src/jdk/nashorn/internal/objects/AccessorPropertyDescriptor.java
index b3731620..4d3fd43d 100644
--- a/src/jdk/nashorn/internal/objects/AccessorPropertyDescriptor.java
+++ b/src/jdk/nashorn/internal/objects/AccessorPropertyDescriptor.java
@@ -185,6 +185,18 @@ public final class AccessorPropertyDescriptor extends ScriptObject implements Pr
     }
 
     @Override
+    public boolean hasAndEquals(final PropertyDescriptor otherDesc) {
+        if (! (otherDesc instanceof AccessorPropertyDescriptor)) {
+            return false;
+        }
+        final AccessorPropertyDescriptor other = (AccessorPropertyDescriptor)otherDesc;
+        return (!has(CONFIGURABLE) || sameValue(configurable, other.configurable)) &&
+               (!has(ENUMERABLE) || sameValue(enumerable, other.enumerable)) &&
+               (!has(GET) || sameValue(get, other.get)) &&
+               (!has(SET) || sameValue(set, other.set));
+    }
+
+    @Override
     public boolean equals(final Object obj) {
         if (this == obj) {
             return true;
diff --git a/src/jdk/nashorn/internal/objects/DataPropertyDescriptor.java b/src/jdk/nashorn/internal/objects/DataPropertyDescriptor.java
index ef3f0a30..39325627 100644
--- a/src/jdk/nashorn/internal/objects/DataPropertyDescriptor.java
+++ b/src/jdk/nashorn/internal/objects/DataPropertyDescriptor.java
@@ -172,6 +172,19 @@ public final class DataPropertyDescriptor extends ScriptObject implements Proper
     }
 
     @Override
+    public boolean hasAndEquals(final PropertyDescriptor otherDesc) {
+        if (! (otherDesc instanceof DataPropertyDescriptor)) {
+            return false;
+        }
+
+        final DataPropertyDescriptor other = (DataPropertyDescriptor)otherDesc;
+        return (!has(CONFIGURABLE) || sameValue(configurable, other.configurable)) &&
+               (!has(ENUMERABLE) || sameValue(enumerable, other.enumerable)) &&
+               (!has(WRITABLE) || sameValue(writable, other.writable)) &&
+               (!has(VALUE) || sameValue(value, other.value));
+    }
+
+    @Override
     public boolean equals(final Object obj) {
         if (this == obj) {
             return true;
diff --git a/src/jdk/nashorn/internal/objects/GenericPropertyDescriptor.java b/src/jdk/nashorn/internal/objects/GenericPropertyDescriptor.java
index f5662efa..221fe002 100644
--- a/src/jdk/nashorn/internal/objects/GenericPropertyDescriptor.java
+++ b/src/jdk/nashorn/internal/objects/GenericPropertyDescriptor.java
@@ -149,6 +149,23 @@ public final class GenericPropertyDescriptor extends ScriptObject implements Pro
     }
 
     @Override
+    public boolean hasAndEquals(final PropertyDescriptor other) {
+        if (has(CONFIGURABLE) && other.has(CONFIGURABLE)) {
+            if (isConfigurable() != other.isConfigurable()) {
+                return false;
+            }
+        }
+
+        if (has(ENUMERABLE) && other.has(ENUMERABLE)) {
+            if (isEnumerable() != other.isEnumerable()) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    @Override
     public boolean equals(final Object obj) {
         if (this == obj) {
             return true;
diff --git a/src/jdk/nashorn/internal/runtime/PropertyDescriptor.java b/src/jdk/nashorn/internal/runtime/PropertyDescriptor.java
index 49a7a9d6..f36bd45e 100644
--- a/src/jdk/nashorn/internal/runtime/PropertyDescriptor.java
+++ b/src/jdk/nashorn/internal/runtime/PropertyDescriptor.java
@@ -151,5 +151,12 @@ public interface PropertyDescriptor {
      * @return true if property exists in implementor
      */
     public boolean has(Object key);
+
+    /**
+     * Check existence and compare attributes of descriptors.
+     *
+     * @return true if every field of this desc exists in otherDesc and has the same value.
+     */
+    public boolean hasAndEquals(PropertyDescriptor otherDesc);
 }
 
diff --git a/src/jdk/nashorn/internal/runtime/ScriptObject.java b/src/jdk/nashorn/internal/runtime/ScriptObject.java
index 4b85ed4e..4b3bb939 100644
--- a/src/jdk/nashorn/internal/runtime/ScriptObject.java
+++ b/src/jdk/nashorn/internal/runtime/ScriptObject.java
@@ -469,7 +469,7 @@ public abstract class ScriptObject extends PropertyListenerManager implements Pr
             return true;
         }
 
-        if (currentDesc.equals(newDesc)) {
+        if (newDesc.hasAndEquals(currentDesc)) {
             // every descriptor field of the new is same as the current
             return true;
         }