8176511: JSObject property access is broken for numeric keys outside the int range
Reviewed-by: sundar
diff --git a/nashorn/src/jdk/nashorn/internal/runtime/linker/JSObjectLinker.java b/nashorn/src/jdk/nashorn/internal/runtime/linker/JSObjectLinker.java
index 7eb23a9..8de9197 100644
--- a/nashorn/src/jdk/nashorn/internal/runtime/linker/JSObjectLinker.java
+++ b/nashorn/src/jdk/nashorn/internal/runtime/linker/JSObjectLinker.java
@@ -175,6 +175,8 @@
final int index = getIndex((Number)key);
if (index > -1) {
return ((JSObject)jsobj).getSlot(index);
+ } else {
+ return ((JSObject)jsobj).getMember(JSType.toString(key));
}
} else if (isString(key)) {
final String name = key.toString();
@@ -192,7 +194,12 @@
if (key instanceof Integer) {
((JSObject)jsobj).setSlot((Integer)key, value);
} else if (key instanceof Number) {
- ((JSObject)jsobj).setSlot(getIndex((Number)key), value);
+ final int index = getIndex((Number)key);
+ if (index > -1) {
+ ((JSObject)jsobj).setSlot(index, value);
+ } else {
+ ((JSObject)jsobj).setMember(JSType.toString(key), value);
+ }
} else if (isString(key)) {
((JSObject)jsobj).setMember(key.toString(), value);
}
diff --git a/nashorn/test/script/basic/JDK-8176511.js b/nashorn/test/script/basic/JDK-8176511.js
new file mode 100644
index 0000000..08fbd55
--- /dev/null
+++ b/nashorn/test/script/basic/JDK-8176511.js
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * JDK-8176511: JSObject property access is broken for numeric keys outside the int range
+ *
+ * @test
+ * @run
+ */
+
+
+var reassignWithNewGlobal = loadWithNewGlobal({
+ script: '(function (o, i) { o[i] = o[i]; })', name: 'internal.js'
+
+});
+
+function test(i) {
+ var o = {};
+ o[i] = true;
+ var before = JSON.stringify(o);
+ reassignWithNewGlobal(o, i);
+ var after = JSON.stringify(o);
+ Assert.assertEquals(before, after);
+}
+
+test(-2147483649);
+test(-2147483648);
+test(2147483647);
+test(2147483648);
+
