Made sort on non-arrays also affect elements on the prototype, for JSC compatability.

src/array.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 691 matching lines @@
         a[i] = a[high_start];
         a[high_start] = element;
       } else {  // order == 0
         i++;
       }
     }
     QuickSort(a, from, low_end);
     QuickSort(a, high_start, to);
   }
 
+  // Copies elements in the range 0..length from obj's prototype chain
+  // to obj itself, if obj has holes. Returns one more than the maximal index
+  // of a prototype property.
+  function CopyFromPrototype(obj, length) {
+    var max = 0;
+    for (var o = obj.__proto__; o; o = o.__proto__) {

[Erik Corry, 2009/05/01 09:58:55]

Can't we call o proto or something?  These 1-letter variable names make things
hard to read.

+      var indices = %GetArrayKeys(o, length);
+      if (indices.length > 0) {
+        if (indices[0] == -1) {
+          // It's an interval

[Erik Corry, 2009/05/01 09:58:55]

Missing full stop.

+          var proto_length = indices[1];
+          for (var i = 0; i < proto_length; i++) {
+            if (!obj.hasOwnProperty(i) && o.hasOwnProperty(i)) {
+              obj[i] = o[i];
+              if (i >= max) { max = i + 1; }
+            }
+          }
+        } else {
+          for (var i = 0; i < indices.length; i++) {
+            var index = indices[i];
+            if (!IS_UNDEFINED(index) &&
+                !obj.hasOwnProperty(index) && o.hasOwnProperty(index)) {
+              obj[index] = o[index];
+              if (index >= max) { max = index + 1; }
+            }
+          }
+        }
+      }
+    }
+    return max;
+  }
+
+  // Set a value of "undefined" on all indices in the range from..to
+  // where a prototype of obj has an element. I.e., shadow all prototype
+  // elements in that range.
+  function ShadowPrototypeElements(obj, from, to) {
+    for (var o = obj.__proto__; o; o = o.__proto__) {

[Erik Corry, 2009/05/01 09:58:55]

And here.

+      var indices = %GetArrayKeys(o, to);
+      if (indices.length > 0) {
+        if (indices[0] == -1) {
+          // It's an interval

[Erik Corry, 2009/05/01 09:58:55]

And here.

+          var proto_length = indices[1];
+          if (proto_length > from) {

[Lasse Reichstein, 2009/05/01 10:05:39]

Wouldn't make a difference. The next line is a loop from "from" to, but not
including, "proto_length". In fact, the entire if can be dropped. If
proto_length <= from the next for loop will be a nop.

+            for (var i = from; i < proto_length; i++) {
+              if (o.hasOwnProperty(i)) {
+                obj[i] = void 0;
+              }
+            }
+          }
+        } else {
+          for (var i = 0; i < indices.length; i++) {
+            var index = indices[i];
+            if (!IS_UNDEFINED(index) && from <= index &&
+                o.hasOwnProperty(index)) {
+              obj[index] = void 0;
+            }
+          }
+        }
+      }
+    }
+  }
+
   var length = ToUint32(this.length);
   if (length < 2) return this;
 
+  var is_array = IS_ARRAY(this);
+  if (!is_array) {
+    // For compatibility with JSC, we also sort elements inherited from
+    // the prototype chain on non-Array objects.
+    // We do this by copying them to this object and sorting only
+    // local elements. This is not very efficient, but sorting with
+    // inherited elements happens very, very rarely, if at all.
+    // The specification allows "implementation dependent" behavior
+    // if an element on the prototype chain has an element that 
+    // might interact with sorting.
+    var max_prototype_element = CopyFromPrototype(this, length);

[Erik Corry, 2009/05/01 09:58:55]

I think the var declaration should be hoisted out of the {} if you are going to
use it outside the {}.  I know JS doesn't care, but I do!

+  }
+
   var num_non_undefined = %RemoveArrayHoles(this, length);
 
   QuickSort(this, 0, num_non_undefined);
 
+  if (!is_array && (num_non_undefined + 1 < max_prototype_element)) {
+    // For compatibility with JSC, we shadow any elements in the prototype
+    // chain that has become exposed by sort moving a hole to its position.
+    ShadowPrototypeElements(this, num_non_undefined, max_prototype_element);
+  }
+
   return this;
 }
 
 
 // The following functions cannot be made efficient on sparse arrays while
 // preserving the semantics, since the calls to the receiver function can add
 // or delete elements from the array.
 function ArrayFilter(f, receiver) {
   if (!IS_FUNCTION(f)) {
     throw MakeTypeError('called_non_callable', [ f ]);
@@ skipping 239 matching lines @@
     ArrayIndexOf: 1,
     ArrayLastIndexOf: 1,
     ArrayPush: 1,
     ArrayReduce: 1,
     ArrayReduceRight: 1
   });
 }
 
 
 SetupArray();