From b5c05a57ad8525d1cc2dd64d335798a1ba54ff83 Mon Sep 17 00:00:00 2001 From: neis Date: Thu, 10 Mar 2016 01:34:42 -0800 Subject: [PATCH] Version 5.0.71.14 (cherry-pick) Merged 86c955fee0aa15c37a7af1bd7dcb0a8bf5a6d92c Fix Array.prototype.sort on proxies. BUG=chromium:591699 LOG=N R=hablich@chromium.org NOTRY=true NOPRESUBMIT=true Review URL: https://codereview.chromium.org/1777203002 Cr-Commit-Position: refs/branch-heads/5.0@{#20} Cr-Branched-From: ad16e6c2cbd2c6b0f2e8ff944ac245561c682ac2-refs/heads/5.0.71@{#1} Cr-Branched-From: bd9df50d75125ee2ad37b3d92c8f50f0a8b5f030-refs/heads/master@{#34215} --- include/v8-version.h | 2 +- src/runtime/runtime-array.cc | 6 ++++-- test/mjsunit/array-sort.js | 6 ++++++ 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/include/v8-version.h b/include/v8-version.h index ee39fc76cbf..69a121c6e95 100644 --- a/include/v8-version.h +++ b/include/v8-version.h @@ -11,7 +11,7 @@ #define V8_MAJOR_VERSION 5 #define V8_MINOR_VERSION 0 #define V8_BUILD_NUMBER 71 -#define V8_PATCH_LEVEL 13 +#define V8_PATCH_LEVEL 14 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.) diff --git a/src/runtime/runtime-array.cc b/src/runtime/runtime-array.cc index 125b87b9e76..f651ed40e12 100644 --- a/src/runtime/runtime-array.cc +++ b/src/runtime/runtime-array.cc @@ -120,9 +120,11 @@ RUNTIME_FUNCTION(Runtime_PushIfAbsent) { RUNTIME_FUNCTION(Runtime_RemoveArrayHoles) { HandleScope scope(isolate); DCHECK(args.length() == 2); - CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0); + CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0); CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[1]); - return *JSObject::PrepareElementsForSort(object, limit); + if (object->IsJSProxy()) return Smi::FromInt(-1); + return *JSObject::PrepareElementsForSort(Handle::cast(object), + limit); } diff --git a/test/mjsunit/array-sort.js b/test/mjsunit/array-sort.js index 36608f5e142..beb8b95b014 100644 --- a/test/mjsunit/array-sort.js +++ b/test/mjsunit/array-sort.js @@ -464,3 +464,9 @@ function TestSortToObject() { assertEquals(0, Number(Array.prototype.sort.call(0))); } TestSortToObject(); + +function TestSortOnProxy() { + var p = new Proxy([2,1,3], {}); + assertEquals([1,2,3], p.sort()); +} +TestSortOnProxy();