Add ToObject call in Array.prototype.sort

test/mjsunit/array-sort.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 427 matching lines @@
 TestSortDoesNotDependOnArrayPrototypePush();
 
 function TestSortDoesNotDependOnArrayPrototypeSort() {
   var arr = [];
   for (var i = 0; i < 2000; i++) arr[i] = {};
   var sortfn = Array.prototype.sort;
   Array.prototype.sort = function() {
     fail('Should not call sort');
   };
   sortfn.call(arr);
+  // Restore for the next test
+  Array.prototype.sort = sortfn;
 }
 
 TestSortDoesNotDependOnArrayPrototypeSort();
+
+function TestSortToObject() {
+  Number.prototype[0] = 5;
+  Number.prototype[1] = 4;
+  Number.prototype.length = 2;
+  x = new Number(0);
+  assertEquals(0, Number(Array.prototype.sort.call(x)));
+  assertEquals(4, x[0]);
+  assertEquals(5, x[1]);
+  assertArrayEquals(["0", "1"], Object.getOwnPropertyNames(x));
+  // The following would throw if ToObject weren't called.
+  assertEquals(0, Number(Array.prototype.sort.call(0)));
+}
+TestSortToObject();