From eef5dee65c1939b8f2a8f54835500776a9649d78 Mon Sep 17 00:00:00 2001
From: hannesw <none@none>
Date: Thu, 11 Dec 2014 14:32:26 +0100
Subject: 8066932: __noSuchMethod__ binds to this-object without proper guard
 Reviewed-by: attila, lagergren

---
 src/jdk/nashorn/internal/runtime/ScriptObject.java |  9 ++--
 test/script/basic/JDK-8066932.js                   | 48 ++++++++++++++++++++++
 2 files changed, 53 insertions(+), 4 deletions(-)
 create mode 100644 test/script/basic/JDK-8066932.js

diff --git a/src/jdk/nashorn/internal/runtime/ScriptObject.java b/src/jdk/nashorn/internal/runtime/ScriptObject.java
index 3f605910..c47497de 100644
--- a/src/jdk/nashorn/internal/runtime/ScriptObject.java
+++ b/src/jdk/nashorn/internal/runtime/ScriptObject.java
@@ -2333,8 +2333,9 @@ public abstract class ScriptObject implements PropertyAccess, Cloneable {
         }
 
         final ScriptFunction func = (ScriptFunction)value;
-        final Object         thiz = scopeCall && func.isStrict() ? ScriptRuntime.UNDEFINED : this;
+        final Object         thiz = scopeCall && func.isStrict() ? UNDEFINED : this;
         // TODO: It'd be awesome if we could bind "name" without binding "this".
+        // Since we're binding this we must use an identity guard here.
         return new GuardedInvocation(
                 MH.dropArguments(
                         MH.constant(
@@ -2342,9 +2343,9 @@ public abstract class ScriptObject implements PropertyAccess, Cloneable {
                                 func.makeBoundFunction(thiz, new Object[] { name })),
                         0,
                         Object.class),
-                NashornGuards.getMapGuard(getMap(), explicitInstanceOfCheck),
-                (SwitchPoint)null,
-                explicitInstanceOfCheck ? null : ClassCastException.class);
+                NashornGuards.combineGuards(
+                        NashornGuards.getIdentityGuard(this),
+                        NashornGuards.getMapGuard(getMap(), true)));
     }
 
     /**
diff --git a/test/script/basic/JDK-8066932.js b/test/script/basic/JDK-8066932.js
new file mode 100644
index 00000000..6dda1e09
--- /dev/null
+++ b/test/script/basic/JDK-8066932.js
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * 
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ * 
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ * 
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * 
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * JDK-8066932: __noSuchMethod__ binds to this-object without proper guard
+ *
+ * @test
+ * @run
+ */
+
+function C(id) {
+    this.id = id;
+}
+
+C.prototype.__noSuchMethod__ = function(name, args) {
+    return this.id;
+};
+
+function test(id) {
+    var c = new C(id);
+    return c.nonExistingMethod();
+}
+
+for (var i = 0; i < 30; i++) {
+    if (test(i) !== i) {
+        throw new Error("Wrong result from noSuchMethod in iteration " + i);
+    }
+}
-- 
cgit v1.2.3