Bug 1260673 - Ensure that Array.sort works with sealed objects; r=jorendorff a=ritu

js/src/builtin/Sorting.js

@@ -235,8 +235,7 @@ function MergeSort(array, len, comparefn) {
     // Until recently typed arrays had no sort method. To work around that
     // many users passed them to Array.prototype.sort. Now that we have a
     // typed array specific sorting method it makes sense to divert to it
-    // when possible. Further, the MoveHoles utility function (used within
-    // MergeSort) is not currently compatible with typed arrays.
+    // when possible.
     if (IsPossiblyWrappedTypedArray(array)) {
         return TypedArraySort.call(array, comparefn);
     }

js/src/tests/ecma_6/Array/sort_holes.js

@@ -54,5 +54,13 @@ assertDeepEq(oneHole[0], {size: 27});
 assertEq(oneHole.length, 2600);
 assertEq(denseCount(oneHole), 1);
 
+// Sealed objects should be sortable, including those with holes (so long
+// as the holes appear at the end, so that they don't need to be moved).
+assertDeepEq(Object.seal([0, 99, -1]).sort((x, y) => 1 * x - y),
+             Object.seal([-1, 0, 99]));
+
+assertDeepEq(Object.seal([1, 5, 4, , ,]).sort((x, y) => 1 * x - y),
+             Object.seal([1, 4, 5, , ,]));
+
 if (typeof reportCompare === 'function')
     reportCompare(0, 0);

js/src/tests/ecma_6/Array/sort_proxy.js

@@ -0,0 +1,38 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// Ensure, via proxy, that only get, set, delete, has, and getOwnPropertyDescriptor
+// are touched during sorting.
+
+const handler = {
+    set: function(target, prop, value) {
+        target[prop] = value;
+        return value;
+    },
+    getPrototypeOf: () => { throw "You shouldn't touch getPrototypeOf!" },
+    setPrototypeOf: () => { throw "You shouldn't touch setPrototypeOf!" },
+    isExtensible: () => { throw "You shouldn't touch isExtensible!" },
+    preventExtensions: () => { throw "You shouldn't touch preventExtensions!" },
+    defineProperty: () => { throw "You shouldn't touch defineProperty!" },
+    ownKeys: () => { throw "You shouldn't touch ownKeys!" },
+    apply: () => { throw "You shouldn't touch apply!" },
+    construct: () => { throw "You shouldn't touch construct!" },
+}
+
+function testArray(arr) {
+    let proxy = new Proxy(arr, handler)
+
+    // The supplied comparators trigger a JavaScript implemented sort.
+    proxy.sort((x, y) => 1 * x - y);
+    arr.sort((x, y) => 1 * x - y);
+
+    for (let i in arr)
+        assertEq(arr[i], proxy[i]);
+}
+
+testArray([-1]);
+testArray([5, -1, 2, 99]);
+testArray([5, -1, , , , 2, 99]);
+testArray([]);
+
+reportCompare(0, 0);