--- old/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/linker/JSObjectLinker.java 2017-03-10 17:21:54.000000000 +0100 +++ new/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/linker/JSObjectLinker.java 2017-03-10 17:21:53.000000000 +0100 @@ -176,6 +176,8 @@ final int index = getIndex((Number)key); if (index > -1) { return ((JSObject)jsobj).getSlot(index); + } else { + return ((JSObject)jsobj).getMember(JSType.toString(key)); } } else if (isString(key)) { final String name = key.toString(); @@ -193,7 +195,12 @@ if (key instanceof Integer) { ((JSObject)jsobj).setSlot((Integer)key, value); } else if (key instanceof Number) { - ((JSObject)jsobj).setSlot(getIndex((Number)key), value); + final int index = getIndex((Number)key); + if (index > -1) { + ((JSObject)jsobj).setSlot(index, value); + } else { + ((JSObject)jsobj).setMember(JSType.toString(key), value); + } } else if (isString(key)) { ((JSObject)jsobj).setMember(key.toString(), value); } --- /dev/null 2017-03-10 17:21:54.000000000 +0100 +++ new/test/script/basic/JDK-8176511.js 2017-03-10 17:21:54.000000000 +0100 @@ -0,0 +1,50 @@ +/* + * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +/** + * JDK-8176511: JSObject property access is broken for numeric keys outside the int range + * + * @test + * @run + */ + + +var reassignWithNewGlobal = loadWithNewGlobal({ + script: '(function (o, i) { o[i] = o[i]; })', name: 'internal.js' + +}); + +function test(i) { + var o = {}; + o[i] = true; + var before = JSON.stringify(o); + reassignWithNewGlobal(o, i); + var after = JSON.stringify(o); + Assert.assertEquals(before, after); +} + +test(-2147483649); +test(-2147483648); +test(2147483647); +test(2147483648); +