Core: Restore 1.x isPlainObject constructor checks

- Guard isPlainObject against inherited scalar constructors

Fixes gh-2982
Close gh-2985

src/core.js

@@ -235,8 +235,10 @@ jQuery.extend( {
 			return false;
 		}
 
+		// Not own constructor property must be Object
 		if ( obj.constructor &&
-				!hasOwn.call( obj.constructor.prototype, "isPrototypeOf" ) ) {
+				!hasOwn.call( obj, "constructor" ) &&
+				!hasOwn.call( obj.constructor.prototype || {}, "isPrototypeOf" ) ) {
 			return false;
 		}
 

test/unit/core.js

@@ -286,7 +286,8 @@ QUnit.test( "type for `Symbol`", function( assert ) {
 });
 
 QUnit.asyncTest( "isPlainObject", function( assert ) {
-	assert.expect( 19 );
+
+	assert.expect( 22 );
 
 	var pass, iframe, doc, parentObj, childObj, deep,
 		fn = function() {};
@@ -294,6 +295,10 @@ QUnit.asyncTest( "isPlainObject", function( assert ) {
 	// The use case that we want to match
 	assert.ok( jQuery.isPlainObject( {} ), "{}" );
 	assert.ok( jQuery.isPlainObject( new window.Object() ), "new Object" );
+	assert.ok( jQuery.isPlainObject( { constructor: fn } ),
+		"plain object with constructor property" );
+	assert.ok( jQuery.isPlainObject( { constructor: "foo" } ),
+		"plain object with primitive constructor property" );
 
 	parentObj = { foo: "bar" };
 	childObj = Object.create( parentObj );
@@ -328,6 +333,10 @@ QUnit.asyncTest( "isPlainObject", function( assert ) {
 	// Again, instantiated objects shouldn't be matched
 	assert.ok( !jQuery.isPlainObject( new fn() ), "new fn" );
 
+	// Instantiated objects with primitive constructors shouldn't be matched
+	fn.prototype.constructor = "foo";
+	assert.ok( !jQuery.isPlainObject( new fn() ), "new fn with primitive constructor" );
+
 	// Deep object
 	deep = { "foo": { "baz": true }, "foo2": document };
 	assert.ok( jQuery.isPlainObject( deep ), "Object with objects is still plain" );