Fix Array.prototype.sort on proxies.

BUG=chromium:591699
LOG=n
R=rossberg

Review URL: https://codereview.chromium.org/1764953002

Cr-Commit-Position: refs/heads/master@{#34498}
This commit is contained in:
neis 2016-03-04 06:42:15 -08:00 committed by Commit bot
parent 433fd6c078
commit 86c955fee0
2 changed files with 10 additions and 2 deletions

View File

@ -120,9 +120,11 @@ RUNTIME_FUNCTION(Runtime_PushIfAbsent) {
RUNTIME_FUNCTION(Runtime_RemoveArrayHoles) {
HandleScope scope(isolate);
DCHECK(args.length() == 2);
CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[1]);
return *JSObject::PrepareElementsForSort(object, limit);
if (object->IsJSProxy()) return Smi::FromInt(-1);
return *JSObject::PrepareElementsForSort(Handle<JSObject>::cast(object),
limit);
}

View File

@ -464,3 +464,9 @@ function TestSortToObject() {
assertEquals(0, Number(Array.prototype.sort.call(0)));
}
TestSortToObject();
function TestSortOnProxy() {
var p = new Proxy([2,1,3], {});
assertEquals([1,2,3], p.sort());
}
TestSortOnProxy();