[njs] Fixed overwriting "constructor" property of built-in prototypes.

[Valentin Bartenev]

details:   https://hg.nginx.org/njs/rev/4296c5b56e30
branches:  
changeset: 982:4296c5b56e30
user:      Valentin Bartenev <vbart at nginx.com>
date:      Thu May 23 15:05:52 2019 +0300
description:
Fixed overwriting "constructor" property of built-in prototypes.

diffstat:

 njs/njs_object.c         |  11 +++++++----
 njs/test/njs_unit_test.c |   9 +++++++++
 2 files changed, 16 insertions(+), 4 deletions(-)

diffs (54 lines):

diff -r fd0918b6dd56 -r 4296c5b56e30 njs/njs_object.c
--- a/njs/njs_object.c	Thu May 23 15:05:51 2019 +0300
+++ b/njs/njs_object.c	Thu May 23 15:05:52 2019 +0300
@@ -2909,8 +2909,11 @@ njs_object_prototype_create_constructor(
 
 found:
 
-    cons = njs_property_constructor_create(vm, &prototype->object.hash,
-                                          &vm->scopes[NJS_SCOPE_GLOBAL][index]);
+    if (setval == NULL) {
+        setval = &vm->scopes[NJS_SCOPE_GLOBAL][index];
+    }
+
+    cons = njs_property_constructor_create(vm, &prototype->object.hash, setval);
     if (nxt_fast_path(cons != NULL)) {
         *retval = *cons;
         return NXT_OK;
@@ -2943,7 +2946,7 @@ njs_property_constructor_create(njs_vm_t
     lhq.value = prop;
     lhq.key_hash = NJS_CONSTRUCTOR_HASH;
     lhq.key = nxt_string_value("constructor");
-    lhq.replace = 0;
+    lhq.replace = 1;
     lhq.pool = vm->mem_pool;
     lhq.proto = &njs_object_hash_proto;
 
@@ -2953,7 +2956,7 @@ njs_property_constructor_create(njs_vm_t
         return &prop->value;
     }
 
-    njs_internal_error(vm, "lvlhsh insert failed");
+    njs_internal_error(vm, "lvlhsh insert/replace failed");
 
     return NULL;
 }
diff -r fd0918b6dd56 -r 4296c5b56e30 njs/test/njs_unit_test.c
--- a/njs/test/njs_unit_test.c	Thu May 23 15:05:51 2019 +0300
+++ b/njs/test/njs_unit_test.c	Thu May 23 15:05:52 2019 +0300
@@ -8480,6 +8480,15 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("Boolean.prototype.constructor === Boolean"),
       nxt_string("true") },
 
+    { nxt_string("Boolean.prototype.constructor = 1;"
+                 "Boolean.prototype.constructor"),
+      nxt_string("1") },
+
+    { nxt_string("var c = Boolean.prototype.constructor;"
+                 "Boolean.prototype.constructor = 1;"
+                 "[c(0), Boolean.prototype.constructor]"),
+      nxt_string("false,1") },
+
     { nxt_string("Boolean.prototype.hasOwnProperty('constructor')"),
       nxt_string("true") },