Array.prototype.sort: Unchecked calls to hasOwnProperty and push and sort

test/mjsunit/array-sort.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 386 matching lines @@
 }
 var arr = [o(1), o(2), o(4), o(8), o(16), o(32), o(64), o(128), o(256), o(-0)];
 var global = this;
 function cmpTest(a, b) {
   assertEquals(global, this);
   assertTrue(a instanceof o);
   assertTrue(b instanceof o);
   return a.val - b.val;
 }
 arr.sort(cmpTest);
+
+// Test sort doesn't depend on Object.prototype.hasOwnProperty. Otherwise a

[arv (Not doing code reviews), 2014/09/15 15:32:47]

You can remove this comment. The name and the code explains what it does.

+// TypeError Exception will be thrown when running sort().
+function TestSortDoesntDependOnObjectPrototypeHasOwnProperty()
+{

[arv (Not doing code reviews), 2014/09/15 15:32:47]

no newline before {

+  Array.prototype.sort.call({__proto__: { hasOwnProperty: null, 0: 1 }, length: 5});

[arv (Not doing code reviews), 2014/09/15 15:32:47]

long line

+
+  var arr = new Array(2);
+  Object.defineProperty(arr, "0", { get: function() {}, set: function() {},

[arv (Not doing code reviews), 2014/09/15 15:32:47]

Why the strange 0 property? It does not seem relevant to the test. Can you get
away with?

arr[0] = undefined;

+    configurable: true});
+  arr.hasOwnProperty = null;
+  arr.sort();
+}
+
+TestSortDoesntDependOnObjectPrototypeHasOwnProperty();
+
+// Test sort doesn't depend on Array.prototype.push. Otherwise a TypeError
+// Exception will be thrown when running sort().
+function TestSortDoesntDepenOnArrayPrototypePush()
+{
+    // InsertionSort is used for arrays which length <= 22
+    var arr = [];
+    for (var i = 0; i < 22; i++) arr[i] = {};
+    delete Array.prototype.push;

[arv (Not doing code reviews), 2014/09/15 15:32:47]

or

Array.prototype.push = function() {
  fail('Should not call push');
};

+    arr.sort();
+
+    // Quicksort is used for arrays which length > 22
+    // Arrays which length > 1000 guarantee GetThirdIndex is executed
+    arr = [];
+    for (var i = 0; i < 2000; ++i) arr[i] = {};
+    arr.sort();
+}
+
+TestSortDoesntDepenOnArrayPrototypePush();
+
+// Test sort doesn't depend on Array.prototype.sort. Otherwise a TypeError
+// Exception will be thrown when running sort().
+function TestSortDoesntDepenOnArrayPrototypeSort()
+{
+    var arr = [];
+    for (var i = 0; i < 2000; i++) arr[i] = {};
+    var sortfn = Array.prototype.sort;
+    delete Array.prototype.sort;
+    sortfn.call(arr);
+}
+
+TestSortDoesntDepenOnArrayPrototypeSort();