Core: Restore 1.x isPlainObject constructor checks

- Guard isPlainObject against inherited scalar constructors

Fixes gh-2982
Close gh-2985

src/core.js

@@ -233,8 +233,10 @@ jQuery.extend( {
 			return false;
 		}
 
+		// Not own constructor property must be Object
 		if ( obj.constructor &&
-				!hasOwn.call( obj.constructor.prototype, "isPrototypeOf" ) ) {
+				!hasOwn.call( obj, "constructor" ) &&
+				!hasOwn.call( obj.constructor.prototype || {}, "isPrototypeOf" ) ) {
 			return false;
 		}
 

test/unit/core.js

@@ -268,7 +268,8 @@ QUnit.test( "type for `Symbol`", function( assert ) {
 } );
 
 QUnit.asyncTest( "isPlainObject", function( assert ) {
-	assert.expect( 19 );
+
+	assert.expect( 22 );
 
 	var pass, iframe, doc, parentObj, childObj, deep,
 		fn = function() {};
@@ -276,6 +277,10 @@ QUnit.asyncTest( "isPlainObject", function( assert ) {
 	// The use case that we want to match
 	assert.ok( jQuery.isPlainObject( {} ), "{}" );
 	assert.ok( jQuery.isPlainObject( new window.Object() ), "new Object" );
+	assert.ok( jQuery.isPlainObject( { constructor: fn } ),
+		"plain object with constructor property" );
+	assert.ok( jQuery.isPlainObject( { constructor: "foo" } ),
+		"plain object with primitive constructor property" );
 
 	parentObj = { foo: "bar" };
 	childObj = Object.create( parentObj );
@@ -310,6 +315,10 @@ QUnit.asyncTest( "isPlainObject", function( assert ) {
 	// Again, instantiated objects shouldn't be matched
 	assert.ok( !jQuery.isPlainObject( new fn() ), "new fn" );
 
+	// Instantiated objects with primitive constructors shouldn't be matched
+	fn.prototype.constructor = "foo";
+	assert.ok( !jQuery.isPlainObject( new fn() ), "new fn with primitive constructor" );
+
 	// Deep object
 	deep = { "foo": { "baz": true }, "foo2": document };
 	assert.ok( jQuery.isPlainObject( deep ), "Object with objects is still plain" );