Throw when a holey property is set in Array.sort

src/js/array.js

Index: src/js/array.js
diff --git a/src/js/array.js b/src/js/array.js
index fca75a3f65f85f32e3300f3669f056793fbf7973..2390cafd5350025b0ce7ada18babbd15a47edf0a 100644
--- a/src/js/array.js
+++ b/src/js/array.js
@@ -971,6 +971,22 @@ function InnerArraySort(array, length, comparefn) {
     max_prototype_element = CopyFromPrototype(array, length);
   }
 
+  if (!%object_is_extensible(array)) {
+    // If the array have holes in the middle of the array,
+    // hole indices can be defined while removing array holes.
+    var last_hole = -1;
+    var first_hole = -1;
+    for (var i = 0; i < length; i++) {
+      if (!HAS_OWN_PROPERTY(array, i)) {
+        if (first_hole == -1) first_hole = i;
+        last_hole = i;
+      }
+    }
+    if (last_hole != -1 && last_hole < length - 1) {
+      throw %make_type_error(kObjectNotExtensible, first_hole);
+    }
+  }
+
   // %RemoveArrayHoles returns -1 if fast removal is not supported.
   var num_non_undefined = %RemoveArrayHoles(array, length);