8030197: Nashorn: Object.defineProperty() can be lured to change fixed NaN property

Reviewed-by: attila, jlaskey

src/jdk/nashorn/internal/objects/AccessorPropertyDescriptor.java

@@ -184,6 +184,18 @@ public final class AccessorPropertyDescriptor extends ScriptObject implements Pr
         return ACCESSOR;
     }
 
+    @Override
+    public boolean hasAndEquals(final PropertyDescriptor otherDesc) {
+        if (! (otherDesc instanceof AccessorPropertyDescriptor)) {
+            return false;
+        }
+        final AccessorPropertyDescriptor other = (AccessorPropertyDescriptor)otherDesc;
+        return (!has(CONFIGURABLE) || sameValue(configurable, other.configurable)) &&
+               (!has(ENUMERABLE) || sameValue(enumerable, other.enumerable)) &&
+               (!has(GET) || sameValue(get, other.get)) &&
+               (!has(SET) || sameValue(set, other.set));
+    }
+
     @Override
     public boolean equals(final Object obj) {
         if (this == obj) {

src/jdk/nashorn/internal/objects/DataPropertyDescriptor.java

@@ -171,6 +171,19 @@ public final class DataPropertyDescriptor extends ScriptObject implements Proper
         return DATA;
     }
 
+    @Override
+    public boolean hasAndEquals(final PropertyDescriptor otherDesc) {
+        if (! (otherDesc instanceof DataPropertyDescriptor)) {
+            return false;
+        }
+
+        final DataPropertyDescriptor other = (DataPropertyDescriptor)otherDesc;
+        return (!has(CONFIGURABLE) || sameValue(configurable, other.configurable)) &&
+               (!has(ENUMERABLE) || sameValue(enumerable, other.enumerable)) &&
+               (!has(WRITABLE) || sameValue(writable, other.writable)) &&
+               (!has(VALUE) || sameValue(value, other.value));
+    }
+
     @Override
     public boolean equals(final Object obj) {
         if (this == obj) {

src/jdk/nashorn/internal/objects/GenericPropertyDescriptor.java

@@ -148,6 +148,23 @@ public final class GenericPropertyDescriptor extends ScriptObject implements Pro
         return GENERIC;
     }
 
+    @Override
+    public boolean hasAndEquals(final PropertyDescriptor other) {
+        if (has(CONFIGURABLE) && other.has(CONFIGURABLE)) {
+            if (isConfigurable() != other.isConfigurable()) {
+                return false;
+            }
+        }
+
+        if (has(ENUMERABLE) && other.has(ENUMERABLE)) {
+            if (isEnumerable() != other.isEnumerable()) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
     @Override
     public boolean equals(final Object obj) {
         if (this == obj) {

src/jdk/nashorn/internal/runtime/PropertyDescriptor.java

@@ -151,5 +151,12 @@ public interface PropertyDescriptor {
      * @return true if property exists in implementor
      */
     public boolean has(Object key);
+
+    /**
+     * Check existence and compare attributes of descriptors.
+     *
+     * @return true if every field of this desc exists in otherDesc and has the same value.
+     */
+    public boolean hasAndEquals(PropertyDescriptor otherDesc);
 }
 

src/jdk/nashorn/internal/runtime/ScriptObject.java

@@ -469,7 +469,7 @@ public abstract class ScriptObject extends PropertyListenerManager implements Pr
             return true;
         }
 
-        if (currentDesc.equals(newDesc)) {
+        if (newDesc.hasAndEquals(currentDesc)) {
             // every descriptor field of the new is same as the current
             return true;
         }

test/script/basic/JDK-8030197.js

+/*
+ * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * 
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ * 
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ * 
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * 
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+/**
+ * JDK-8030197: Nashorn: Object.defineProperty() can be lured to change fixed NaN property
+ *
+ * @test
+ * @run
+ */
+
+function str(n) {
+    var a = new Uint8Array(new Float64Array([n]).buffer);
+    return Array.apply(null, a).reduceRight(
+        function(acc, v){
+            return acc + (v < 10 ? "0" : "") + v.toString(16);
+        }, "");
+}
+
+var o = Object.defineProperty({}, "NaN", { value: NaN })
+var str1 = str(o.NaN);
+Object.defineProperty(o, "NaN", { value: 0/0 })
+var str2 = str(o.NaN);
+if (str1 != str2) {
+    fail("NaN bit pattern changed");
+}