8151809: ES6 Map/Set insertion with existing keys changes iteration order

Reviewed-by: lagergren, mhaupt
diff --git a/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/objects/LinkedMap.java b/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/objects/LinkedMap.java
index 917bf09..4e7187c 100644
--- a/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/objects/LinkedMap.java
+++ b/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/objects/LinkedMap.java
@@ -62,7 +62,7 @@
      */
     static class Node {
         private final Object key;
-        private final Object value;
+        private volatile Object value;
 
         private volatile boolean alive = true;
         private volatile Node prev;
@@ -103,6 +103,14 @@
         public Object getValue() {
             return value;
         }
+
+        /**
+         * Set the node's value
+         * @param value the new value
+         */
+        void setValue(final Object value) {
+            this.value = value;
+        }
     }
 
     /**
@@ -150,12 +158,14 @@
      * @param value the value
      */
     public void set(final Object key, final Object value) {
-        final Node newNode = new Node(key, value);
-        final Node oldNode = data.put(key, newNode);
-        if (oldNode != null) {
-            unlink(oldNode);
+        Node node = data.get(key);
+        if (node != null) {
+            node.setValue(value);
+        } else {
+            node = new Node(key, value);
+            data.put(key, node);
+            link(node);
         }
-        link(newNode);
     }
 
     /**
diff --git a/nashorn/test/script/basic/es6/JDK-8151809.js b/nashorn/test/script/basic/es6/JDK-8151809.js
new file mode 100644
index 0000000..ac04d3b
--- /dev/null
+++ b/nashorn/test/script/basic/es6/JDK-8151809.js
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * 
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ * 
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ * 
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * 
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * JDK-8151809: ES6 Map/Set insertion with existing keys changes iteration order
+ *
+ * @test
+ * @run
+ * @option --language=es6
+ */
+
+function assertSetIteratorResult(result, expectedDone, expectedValue) {
+    Assert.assertEquals(result.done, expectedDone);
+    Assert.assertEquals(result.value, expectedValue);
+}
+
+function assertMapIteratorResult(result, expectedDone, expectedKey, expectedValue) {
+    Assert.assertEquals(result.done, expectedDone);
+    if (expectedDone) {
+        Assert.assertEquals(result.value, undefined);
+    } else {
+        Assert.assertEquals(result.value[0], expectedKey);
+        Assert.assertEquals(result.value[1], expectedValue);
+    }
+}
+
+let set = new Set(["foo", "bar", "foo"]);
+let iter = set[Symbol.iterator]();
+assertSetIteratorResult(iter.next(), false, "foo");
+assertSetIteratorResult(iter.next(), false, "bar");
+assertSetIteratorResult(iter.next(), true);
+
+set.add ("foo");
+iter = set[Symbol.iterator]();
+assertSetIteratorResult(iter.next(), false, "foo", false);
+assertSetIteratorResult(iter.next(), false, "bar", false);
+assertSetIteratorResult(iter.next(), true);
+
+set.delete("foo");
+set.add ("foo");
+assertSetIteratorResult(iter.next(), true);
+iter = set[Symbol.iterator]();
+assertSetIteratorResult(iter.next(), false, "bar", false);
+assertSetIteratorResult(iter.next(), false, "foo", false);
+assertSetIteratorResult(iter.next(), true);
+
+
+let map = new Map([["foo", 1], ["bar", 2], ["foo", 3]]);
+iter = map[Symbol.iterator]();
+assertMapIteratorResult(iter.next(), false, "foo", 3);
+assertMapIteratorResult(iter.next(), false, "bar", 2);
+assertMapIteratorResult(iter.next(), true);
+
+
+map.set("foo", 4);
+iter = map[Symbol.iterator]();
+assertMapIteratorResult(iter.next(), false, "foo", 4);
+assertMapIteratorResult(iter.next(), false, "bar", 2);
+assertMapIteratorResult(iter.next(), true);
+
+map.delete("foo");
+map.set("foo", 5);
+assertMapIteratorResult(iter.next(), true);
+iter = map[Symbol.iterator]();
+assertMapIteratorResult(iter.next(), false, "bar", 2);
+assertMapIteratorResult(iter.next(), false, "foo", 5);
+assertMapIteratorResult(iter.next(), true);