[builtins] Sort only up to a given length in Array.p.sort

Always return the given length (limit) for typed arrays in PrepareElementsForSort
since typed arrays do not have holes.

Bug: v8:6719
Change-Id: Ic455ceca6563fc66a4e4a78c7bf5df1ad17afb4a
Reviewed-on: https://chromium-review.googlesource.com/615104
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51588}
This commit is contained in:
Choongwoo Han 2018-02-16 23:21:38 +09:00 committed by Commit Bot
parent 78cba2ae00
commit 1a1e93526e
2 changed files with 15 additions and 1 deletions

View File

@ -149,7 +149,8 @@ Object* PrepareElementsForSort(Handle<JSObject> object, uint32_t limit) {
JSObject::ValidateElements(*object);
} else if (object->HasFixedTypedArrayElements()) {
// Typed arrays cannot have holes or undefined elements.
return Smi::FromInt(FixedArrayBase::cast(object->elements())->length());
int array_length = FixedArrayBase::cast(object->elements())->length();
return Smi::FromInt(Min(limit, static_cast<uint32_t>(array_length)));
} else if (!object->HasDoubleElements()) {
JSObject::EnsureWritableFastElements(object);
}

View File

@ -503,6 +503,19 @@ function TestSortOnNonExtensible() {
}
TestSortOnNonExtensible();
function TestSortOnTypedArray() {
var array = new Int8Array([10,9,8,7,6,5,4,3,2,1]);
Object.defineProperty(array, "length", {value: 5});
Array.prototype.sort.call(array);
assertEquals(array, new Int8Array([10,6,7,8,9,5,4,3,2,1]));
var array = new Int8Array([10,9,8,7,6,5,4,3,2,1]);
Object.defineProperty(array, "length", {value: 15});
Array.prototype.sort.call(array);
assertEquals(array, new Int8Array([1,10,2,3,4,5,6,7,8,9]));
}
TestSortOnTypedArray();
// Test special prototypes
(function testSortSpecialPrototypes() {