Version 5.0.71.14 (cherry-pick)

Merged 86c955f

Fix Array.prototype.sort on proxies.

BUG=chromium:591699
LOG=N
R=hablich@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1777203002

Cr-Commit-Position: refs/branch-heads/5.0@{#20}
Cr-Branched-From: ad16e6c-refs/heads/5.0.71@{#1}
Cr-Branched-From: bd9df50-refs/heads/master@{#34215}

include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 5
 #define V8_MINOR_VERSION 0
 #define V8_BUILD_NUMBER 71
-#define V8_PATCH_LEVEL 13
+#define V8_PATCH_LEVEL 14
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

src/runtime/runtime-array.cc

@@ -120,9 +120,11 @@ RUNTIME_FUNCTION(Runtime_PushIfAbsent) {
 RUNTIME_FUNCTION(Runtime_RemoveArrayHoles) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 2);
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
   CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[1]);
-  return *JSObject::PrepareElementsForSort(object, limit);
+  if (object->IsJSProxy()) return Smi::FromInt(-1);
+  return *JSObject::PrepareElementsForSort(Handle<JSObject>::cast(object),
+                                           limit);
 }
 
 

test/mjsunit/array-sort.js

@@ -464,3 +464,9 @@ function TestSortToObject() {
   assertEquals(0, Number(Array.prototype.sort.call(0)));
 }
 TestSortToObject();
+
+function TestSortOnProxy() {
+  var p = new Proxy([2,1,3], {});
+  assertEquals([1,2,3], p.sort());
+}
+TestSortOnProxy();