Array.prototype.sort: Unchecked calls to hasOwnProperty and push and sort

test/mjsunit/array-sort.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 386 matching lines @@
 }
 var arr = [o(1), o(2), o(4), o(8), o(16), o(32), o(64), o(128), o(256), o(-0)];
 var global = this;
 function cmpTest(a, b) {
   assertEquals(global, this);
   assertTrue(a instanceof o);
   assertTrue(b instanceof o);
   return a.val - b.val;
 }
 arr.sort(cmpTest);
+
+function TestSortDoesntDependOnObjectPrototypeHasOwnProperty() {
+  Array.prototype.sort.call({__proto__: { hasOwnProperty: null, 0: 1 },

[arv (Not doing code reviews), 2014/09/15 18:05:28]

Array.prototype.sort.call({
  __proto__: { hasOwnProperty: null, 0: 1 },
  length: 5
});

+    length: 5});
+
+  var arr = [];
+  Object.defineProperty(arr, "0", {});

[arv (Not doing code reviews), 2014/09/15 18:05:28]

Now I'm confused again ;-)

Don't we treat the '0' as 0 when we do defineProperty?

[Diego Pino, 2014/09/16 09:56:38]

Yes, it's the same to use '0' or 0 in this case.

I made a mistake in this test, the array needs to have at least two elements and
the accessor needs to have a getter and a setter, otherwise there's a TypeError
(Cannot assign to read only property '0' of [object Array]). As the array had
only one element, it didn't really sort anything.

+  arr.hasOwnProperty = null;
+  arr.sort();
+}
+
+TestSortDoesntDependOnObjectPrototypeHasOwnProperty();
+
+function TestSortDoesntDepenOnArrayPrototypePush() {

[wingo, 2014/09/16 08:47:48]

"Depend".  Also better to write out DoesNot instead of Doesnt

+  // InsertionSort is used for arrays which length <= 22
+  var arr = [];
+  for (var i = 0; i < 22; i++) arr[i] = {};
+  Array.prototype.push = function() {
+      fail('Should not call push');

[arv (Not doing code reviews), 2014/09/15 18:05:28]

indent 2 spaces.

+  }

[arv (Not doing code reviews), 2014/09/15 18:05:28]

;

+  arr.sort();
+
+  // Quicksort is used for arrays which length > 22
+  // Arrays which length > 1000 guarantee GetThirdIndex is executed
+  arr = [];
+  for (var i = 0; i < 2000; ++i) arr[i] = {};
+  arr.sort();
+}
+
+TestSortDoesntDepenOnArrayPrototypePush();
+
+function TestSortDoesntDepenOnArrayPrototypeSort() {
+  var arr = [];
+  for (var i = 0; i < 2000; i++) arr[i] = {};
+  var sortfn = Array.prototype.sort;
+  Array.prototype.sort = function() {
+    fail('Should not call sort');
+  }

[arv (Not doing code reviews), 2014/09/15 18:05:28]

;

+  sortfn.call(arr);
+}
+
+TestSortDoesntDepenOnArrayPrototypeSort();