Fix Array.prototype.sort for *_STRING_WRAPPER_ELEMENTS

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 6e0b3d5a4f1a4d56c72d2adb55f4deecf63d3a0d..296acd3988af34f67bea11729edfc314168b33cb 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -17619,6 +17619,11 @@ Handle<Object> JSObject::PrepareElementsForSort(Handle<JSObject> object,
     return handle(Smi::FromInt(-1), isolate);
   }
 
+  if (object->HasStringWrapperElements()) {
+    int len = String::cast(Handle<JSValue>::cast(object)->value())->length();
+    return handle(Smi::FromInt(len), isolate);
+  }
+
   if (object->HasDictionaryElements()) {
     // Convert to fast elements containing only the existing properties.
     // Ordering is irrelevant, since we are going to sort anyway.