Array.prototype.sort: Unchecked calls to hasOwnProperty and push and sort

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index cf99aceb699de5c1de52f66510f7b07f6048ba7b..e9c853ffab3a7e06483c165acebfd6119ffc9d94 100644
--- a/src/array.js
+++ b/src/array.js
@@ -864,10 +864,11 @@ function ArraySort(comparefn) {
     // Use both 'from' and 'to' to determine the pivot candidates.
     var increment = 200 + ((to - from) & 15);
     for (var i = from + 1; i < to - 1; i += increment) {
-      t_array.push([i, a[i]]);
+      ArrayPush.call(t_array, [i, a[i]]);

[arv (Not doing code reviews), 2014/09/10 15:47:39]

%_CallFunction(t_array, [i, a[i]], ArrayPush)

But why are we using push here? Can't we just do?

t_array[nextIndex] = [i, a[i]]

     }
-    t_array.sort(function(a, b) {
-        return %_CallFunction(receiver, a[1], b[1], comparefn) } );
+    ArraySort.call(t_array, function(a, b) {

[arv (Not doing code reviews), 2014/09/10 15:47:39]

%_CallFunction

+        return %_CallFunction(receiver, a[1], b[1], comparefn);
+    });
     var third_index = t_array[t_array.length >> 1][0];
     return third_index;
   }
@@ -962,6 +963,7 @@ function ArraySort(comparefn) {
   // to obj itself, if obj has holes. Return one more than the maximal index
   // of a prototype property.
   var CopyFromPrototype = function CopyFromPrototype(obj, length) {
+    var hasOwnProperty = $Object.prototype.hasOwnProperty;

[arv (Not doing code reviews), 2014/09/10 15:47:39]

Either use %HasOwnProperty or ObjectHasOwnProperty. The benefit of the second
one is that it will also work with Proxies but I'm not sure we need to handle
those here?

     var max = 0;
     for (var proto = %GetPrototype(obj); proto; proto = %GetPrototype(proto)) {
       var indices = %GetArrayKeys(proto, length);
@@ -969,7 +971,7 @@ function ArraySort(comparefn) {
         // It's an interval.
         var proto_length = indices;
         for (var i = 0; i < proto_length; i++) {
-          if (!obj.hasOwnProperty(i) && proto.hasOwnProperty(i)) {
+          if (!hasOwnProperty.call(obj, i) && hasOwnProperty.call(proto, i)) {

[arv (Not doing code reviews), 2014/09/10 15:47:39]

call could have been replaced too :'(

Use

%_CallFunction(obj, i, ObjectHasOwnProperty)

             obj[i] = proto[i];
             if (i >= max) { max = i + 1; }
           }
@@ -978,7 +980,7 @@ function ArraySort(comparefn) {
         for (var i = 0; i < indices.length; i++) {
           var index = indices[i];
           if (!IS_UNDEFINED(index) &&
-              !obj.hasOwnProperty(index) && proto.hasOwnProperty(index)) {
+              !hasOwnProperty.call(obj, index) && hasOwnProperty.call(proto, index)) {
             obj[index] = proto[index];
             if (index >= max) { max = index + 1; }
           }
@@ -992,13 +994,14 @@ function ArraySort(comparefn) {
   // where a prototype of obj has an element. I.e., shadow all prototype
   // elements in that range.
   var ShadowPrototypeElements = function(obj, from, to) {
+    var hasOwnProperty = $Object.prototype.hasOwnProperty;
     for (var proto = %GetPrototype(obj); proto; proto = %GetPrototype(proto)) {
       var indices = %GetArrayKeys(proto, to);
       if (IS_NUMBER(indices)) {
         // It's an interval.
         var proto_length = indices;
         for (var i = from; i < proto_length; i++) {
-          if (proto.hasOwnProperty(i)) {
+          if (hasOwnProperty.call(proto, i)) {
             obj[i] = UNDEFINED;
           }
         }
@@ -1006,7 +1009,7 @@ function ArraySort(comparefn) {
         for (var i = 0; i < indices.length; i++) {
           var index = indices[i];
           if (!IS_UNDEFINED(index) && from <= index &&
-              proto.hasOwnProperty(index)) {
+              hasOwnProperty.call(proto, index)) {
             obj[index] = UNDEFINED;
           }
         }
@@ -1029,14 +1032,14 @@ function ArraySort(comparefn) {
       }
       // Maintain the invariant num_holes = the number of holes in the original
       // array with indices <= first_undefined or > last_defined.
-      if (!obj.hasOwnProperty(first_undefined)) {
+      if (!hasOwnProperty.call(obj, first_undefined)) {
         num_holes++;
       }
 
       // Find last defined element.
       while (first_undefined < last_defined &&
              IS_UNDEFINED(obj[last_defined])) {
-        if (!obj.hasOwnProperty(last_defined)) {
+        if (!$Object.prototype.hasOwnProperty.call(obj, last_defined)) {
           num_holes++;
         }
         last_defined--;