Fix Issue 326. Handle sorting of non-array objects correctly.

src/array.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 691 matching lines @@
         a[i] = a[high_start];
         a[high_start] = element;
       } else {  // order == 0
         i++;
       }
     }
     QuickSort(a, from, low_end);
     QuickSort(a, high_start, to);
   }
 
-  var old_length = ToUint32(this.length);
-  if (old_length < 2) return this;
+  var length = ToUint32(this.length);
+  if (!(length >= 2)) return this;
 
-  %RemoveArrayHoles(this);
+  var num_non_undefined = %RemoveArrayHoles(this, length);
 
-  var length = ToUint32(this.length);
-
-  // Move undefined elements to the end of the array.
-  for (var i = 0; i < length; ) {
-    if (IS_UNDEFINED(this[i])) {
-      length--;
-      this[i] = this[length];
-      this[length] = void 0;
-    } else {
-      i++;
-    }
-  }
-
-  QuickSort(this, 0, length);
-
-  // We only changed the length of the this object (in
-  // RemoveArrayHoles) if it was an array.  We are not allowed to set
-  // the length of the this object if it is not an array because this
-  // might introduce a new length property.
-  if (IS_ARRAY(this)) {
-    this.length = old_length;
-  }
+  QuickSort(this, 0, num_non_undefined);
 
   return this;
 }
 
 
 // The following functions cannot be made efficient on sparse arrays while
 // preserving the semantics, since the calls to the receiver function can add
 // or delete elements from the array.
 function ArrayFilter(f, receiver) {
   if (!IS_FUNCTION(f)) {
@@ skipping 240 matching lines @@
     ArrayIndexOf: 1,
     ArrayLastIndexOf: 1,
     ArrayPush: 1,
     ArrayReduce: 1,
     ArrayReduceRight: 1
   });
 }
 
 
 SetupArray();