Array.prototype.sort: Unchecked calls to hasOwnProperty and push and sort

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index 3d4a066bc5e0c244a3e0187d267e3e67e8515a01..68e85210d8acbce2c076f0832aa38a1e6d1d85aa 100644
--- a/src/array.js
+++ b/src/array.js
@@ -863,11 +863,12 @@ function ArraySort(comparefn) {
     var t_array = [];
     // Use both 'from' and 'to' to determine the pivot candidates.
     var increment = 200 + ((to - from) & 15);
-    for (var i = from + 1; i < to - 1; i += increment) {
-      t_array.push([i, a[i]]);
+    for (var i = from + 1, j = 0; i < to - 1; i += increment, j++) {
+      t_array[j] = [i, a[i]];
     }
-    t_array.sort(function(a, b) {
-        return %_CallFunction(receiver, a[1], b[1], comparefn) } );
+    %_CallFunction(t_array, function(a, b) {
+      return %_CallFunction(receiver, a[1], b[1], comparefn);
+    }, ArraySort);
     var third_index = t_array[t_array.length >> 1][0];
     return third_index;
   }
@@ -969,7 +970,8 @@ function ArraySort(comparefn) {
         // It's an interval.
         var proto_length = indices;
         for (var i = 0; i < proto_length; i++) {
-          if (!obj.hasOwnProperty(i) && proto.hasOwnProperty(i)) {
+          if (!%_CallFunction(obj, i, ObjectHasOwnProperty) &&

[arv (Not doing code reviews), 2014/09/15 18:05:28]

Maybe use a helper or a macro for these?

macro HAS_OWN_PROPERTY(obj, n)
  %_CallFunction(obj, n, ObjectHasOwnProperty)
endmacro

+              %_CallFunction(proto, i, ObjectHasOwnProperty)) {
             obj[i] = proto[i];
             if (i >= max) { max = i + 1; }
           }
@@ -978,7 +980,8 @@ function ArraySort(comparefn) {
         for (var i = 0; i < indices.length; i++) {
           var index = indices[i];
           if (!IS_UNDEFINED(index) &&
-              !obj.hasOwnProperty(index) && proto.hasOwnProperty(index)) {
+              !%_CallFunction(obj, index, ObjectHasOwnProperty) &&
+              %_CallFunction(proto, index, ObjectHasOwnProperty)) {
             obj[index] = proto[index];
             if (index >= max) { max = index + 1; }
           }
@@ -998,7 +1001,7 @@ function ArraySort(comparefn) {
         // It's an interval.
         var proto_length = indices;
         for (var i = from; i < proto_length; i++) {
-          if (proto.hasOwnProperty(i)) {
+          if (%_CallFunction(proto, i, ObjectHasOwnProperty)) {
             obj[i] = UNDEFINED;
           }
         }
@@ -1006,7 +1009,7 @@ function ArraySort(comparefn) {
         for (var i = 0; i < indices.length; i++) {
           var index = indices[i];
           if (!IS_UNDEFINED(index) && from <= index &&
-              proto.hasOwnProperty(index)) {
+              %_CallFunction(proto, index, ObjectHasOwnProperty)) {
             obj[index] = UNDEFINED;
           }
         }
@@ -1029,14 +1032,14 @@ function ArraySort(comparefn) {
       }
       // Maintain the invariant num_holes = the number of holes in the original
       // array with indices <= first_undefined or > last_defined.
-      if (!obj.hasOwnProperty(first_undefined)) {
+      if (!%_CallFunction(obj, first_undefined, ObjectHasOwnProperty)) {
         num_holes++;
       }
 
       // Find last defined element.
       while (first_undefined < last_defined &&
              IS_UNDEFINED(obj[last_defined])) {
-        if (!obj.hasOwnProperty(last_defined)) {
+        if (!%_CallFunction(obj, last_defined, ObjectHasOwnProperty)) {
           num_holes++;
         }
         last_defined--;