[array] Use 'strict' DeleteProperty in Array#sort

This CL changes the generic version of Array#sort to use 'strict'
DeleteProperty when "moving" holes to the end of the sort range.

This brings V8 not only in line with the proposed Array#sort spec
change, but also closer to what other engines do. Now all engines
throw a TypeError when the new test case is run.

R=jgruber@chromium.org, mathias@chromium.org

Bug: v8:8714
Change-Id: Ic5bcd152ad55fd534c1e9e3218393bfe4a50667e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666995
Commit-Queue: Simon Zünd <szuend@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62273}

test/mjsunit/array-sort.js

@@ -559,11 +559,24 @@ function TestPrototypeHoles() {
     assertEquals(19, xs[9]);
   }
 
-  test(true);
   test(false);
+  // Expect a TypeError when trying to delete the accessor.
+  assertThrows(() => test(true), TypeError);
 }
 TestPrototypeHoles();
 
+// The following test ensures that [[Delete]] is called and it throws.
+function TestArrayWithAccessorThrowsOnDelete() {
+  let array = [5, 4, 1, /*hole*/, /*hole*/];
+
+  Object.defineProperty(array, '4', {
+    get: () => array.foo,
+    set: (val) => array.foo = val
+  });
+  assertThrows(() => array.sort((a, b) => a - b), TypeError);
+}
+TestArrayWithAccessorThrowsOnDelete();
+
 // The following test ensures that elements on the prototype are also copied
 // for JSArrays and not only JSObjects.
 function TestArrayPrototypeHasElements() {

third_party/v8/builtins/array-sort.tq

@@ -298,7 +298,7 @@ namespace array {
       context: Context, sortState: SortState, index: Smi): Smi {
     const receiver = sortState.receiver;
     if (!HasProperty_Inline(receiver, index)) return kSuccess;
-    DeleteProperty(receiver, index, kSloppy);
+    DeleteProperty(receiver, index, kStrict);
     return kSuccess;
   }