Fixed overwriting "constructor" property of built-in prototypes.

diff --git a/njs/njs_object.c b/njs/njs_object.c
index 46b15cd49cfef6b6916a2945480ce5ca1fe6e64f..0d2ef7c8755e8199accb62ce0e2aeaa35c209810 100644 (file)
--- a/njs/njs_object.c
+++ b/njs/njs_object.c
@@ -2909,8 +2909,11 @@ njs_object_prototype_create_constructor(njs_vm_t *vm, njs_value_t *value,
 
 found:
 
-    cons = njs_property_constructor_create(vm, &prototype->object.hash,
-                                          &vm->scopes[NJS_SCOPE_GLOBAL][index]);
+    if (setval == NULL) {
+        setval = &vm->scopes[NJS_SCOPE_GLOBAL][index];
+    }
+
+    cons = njs_property_constructor_create(vm, &prototype->object.hash, setval);
     if (nxt_fast_path(cons != NULL)) {
         *retval = *cons;
         return NXT_OK;
@@ -2943,7 +2946,7 @@ njs_property_constructor_create(njs_vm_t *vm, nxt_lvlhsh_t *hash,
     lhq.value = prop;
     lhq.key_hash = NJS_CONSTRUCTOR_HASH;
     lhq.key = nxt_string_value("constructor");
-    lhq.replace = 0;
+    lhq.replace = 1;
     lhq.pool = vm->mem_pool;
     lhq.proto = &njs_object_hash_proto;
 
@@ -2953,7 +2956,7 @@ njs_property_constructor_create(njs_vm_t *vm, nxt_lvlhsh_t *hash,
         return &prop->value;
     }
 
-    njs_internal_error(vm, "lvlhsh insert failed");
+    njs_internal_error(vm, "lvlhsh insert/replace failed");
 
     return NULL;
 }

diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index ecb873db2da82de8b4bd9322144d4f4fca4c52d1..a6593a568ae77101bfc37fff0642e45039b2d127 100644 (file)
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -8480,6 +8480,15 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("Boolean.prototype.constructor === Boolean"),
       nxt_string("true") },
 
+    { nxt_string("Boolean.prototype.constructor = 1;"
+                 "Boolean.prototype.constructor"),
+      nxt_string("1") },
+
+    { nxt_string("var c = Boolean.prototype.constructor;"
+                 "Boolean.prototype.constructor = 1;"
+                 "[c(0), Boolean.prototype.constructor]"),
+      nxt_string("false,1") },
+
     { nxt_string("Boolean.prototype.hasOwnProperty('constructor')"),
       nxt_string("true") },