Throw when a holey property is set in Array.sort

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 8c05ff8bdd3e07349b54771eed2d323b41614d74..307c9058fc411398f70ed935d0a6f7d31c1d3ce0 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -16880,7 +16880,7 @@ Handle<Object> JSObject::PrepareSlowElementsForSort(
 Handle<Object> JSObject::PrepareElementsForSort(Handle<JSObject> object,
                                                 uint32_t limit) {
   Isolate* isolate = object->GetIsolate();
-  if (object->HasSloppyArgumentsElements()) {
+  if (object->HasSloppyArgumentsElements() || !object->map()->is_extensible()) {
     return handle(Smi::FromInt(-1), isolate);
   }