Add ToObject call in Array.prototype.sort

test/mjsunit/array-sort.js

Index: test/mjsunit/array-sort.js
diff --git a/test/mjsunit/array-sort.js b/test/mjsunit/array-sort.js
index 62755426ade76675c0e84f333ce18146d229d595..36608f5e142e455cb86659d2c8814007cb1fc579 100644
--- a/test/mjsunit/array-sort.js
+++ b/test/mjsunit/array-sort.js
@@ -445,6 +445,22 @@ function TestSortDoesNotDependOnArrayPrototypeSort() {
     fail('Should not call sort');
   };
   sortfn.call(arr);
+  // Restore for the next test
+  Array.prototype.sort = sortfn;
 }
 
 TestSortDoesNotDependOnArrayPrototypeSort();
+
+function TestSortToObject() {
+  Number.prototype[0] = 5;
+  Number.prototype[1] = 4;
+  Number.prototype.length = 2;
+  x = new Number(0);
+  assertEquals(0, Number(Array.prototype.sort.call(x)));
+  assertEquals(4, x[0]);
+  assertEquals(5, x[1]);
+  assertArrayEquals(["0", "1"], Object.getOwnPropertyNames(x));
+  // The following would throw if ToObject weren't called.
+  assertEquals(0, Number(Array.prototype.sort.call(0)));
+}
+TestSortToObject();