Fix bug in comparison logic of object property (#22348)

Summary:
`instance.hasOwnProperty` has potential danger because of some object could be eliminate own prototype chain. Update code be more reliable.

This PR is solution of #22308 issue. (Fixes #22308)
Pull Request resolved: #22348

Differential Revision: D13334882

Pulled By: cpojer

fbshipit-source-id: 9b9310a972e933af1962666d7b0c683ff43cc5b2

Libraries/vendor/core/mergeInto.js

@@ -23,7 +23,7 @@ function mergeInto(one, two) {
   if (two != null) {
     checkMergeObjectArg(two);
     for (var key in two) {
-      if (!two.hasOwnProperty(key)) {
+      if (!Object.prototype.hasOwnProperty.call(two, key)) {
         continue;
       }
       one[key] = two[key];