8005848: assigning to global toString variable affects Object.prototype.toString

Reviewed-by: jlaskey, lagergren

nashorn/src/jdk/nashorn/internal/runtime/ScriptObject.java

@@ -631,9 +631,34 @@ public abstract class ScriptObject extends PropertyListenerManager implements Pr
      * @return FindPropertyData or null if not found.
      */
     public final FindProperty findProperty(final String key, final boolean deep) {
+        return findProperty(key, deep, false);
+    }
+
+    /**
+     * Low level property API (not using property descriptors)
+     * <p>
+     * Find a property in the prototype hierarchy. Note: this is final and not
+     * a good idea to override. If you have to, use
+     * {jdk.nashorn.internal.objects.NativeArray{@link #getProperty(String)} or
+     * {jdk.nashorn.internal.objects.NativeArray{@link #getPropertyDescriptor(String)} as the
+     * overriding way to find array properties
+     *
+     * @see jdk.nashorn.internal.objects.NativeArray
+     *
+     * @param key  Property key.
+     * @param deep Whether the search should look up proto chain.
+     * @param stopOnNonScope should a deep search stop on the first non-scope object?
+     *
+     * @return FindPropertyData or null if not found.
+     */
+    public final FindProperty findProperty(final String key, final boolean deep, final boolean stopOnNonScope) {
         int depth = 0;
 
         for (ScriptObject self = this; self != null; self = self.getProto()) {
+            // if doing deep search, stop search on the first non-scope object if asked to do so
+            if (stopOnNonScope && depth != 0 && !self.isScope()) {
+                break;
+            }
             final PropertyMap selfMap  = self.getMap();
             final Property    property = selfMap.findProperty(key);
 
@@ -1731,9 +1756,17 @@ public abstract class ScriptObject extends PropertyListenerManager implements Pr
             return findMegaMorphicSetMethod(desc, name);
         }
 
-        FindProperty find = findProperty(name, true);
+        final boolean scope = isScope();
+        /*
+         * If doing property set on a scope object, we should stop proto search on the first
+         * non-scope object. Without this, for exmaple, when assigning "toString" on global scope,
+         * we'll end up assigning it on it's proto - which is Object.prototype.toString !!
+         *
+         * toString = function() { print("global toString"); } // don't affect Object.prototype.toString
+         */
+        FindProperty find = findProperty(name, true, scope);
         // If it's not a scope search, then we don't want any inherited properties except those with user defined accessors.
-        if (!isScope() && find != null && find.isInherited() && !(find.getProperty() instanceof UserAccessorProperty)) {
+        if (!scope && find != null && find.isInherited() && !(find.getProperty() instanceof UserAccessorProperty)) {
             // We should still check if inherited data property is not writable
             if (isExtensible() && !find.isWritable()) {
                 return createEmptySetMethod(desc, "property.not.writable", false);

nashorn/test/script/basic/JDK_8005848.js

@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * JDK-8005848 : assigning to global toString variable affects Object.prototype.toString 
+ *
+ * @test
+ * @run
+ */
+
+toString = function() {
+    print("global's toString called!!");
+}
+
+var obj = {};
+var str = obj.toString();
+if (str != "[object Object]") {
+    print("FAILED: toString does not return expected value");
+}