Upgrade V8 to version 4.9.385.28
https://chromium.googlesource.com/v8/v8/+/4.9.385.28
FPIIM-449
Change-Id: I4b2e74289d4bf3667f2f3dc8aa2e541f63e26eb4
diff --git a/test/mjsunit/array-sort.js b/test/mjsunit/array-sort.js
index 6275542..36608f5 100644
--- a/test/mjsunit/array-sort.js
+++ b/test/mjsunit/array-sort.js
@@ -445,6 +445,22 @@
fail('Should not call sort');
};
sortfn.call(arr);
+ // Restore for the next test
+ Array.prototype.sort = sortfn;
}
TestSortDoesNotDependOnArrayPrototypeSort();
+
+function TestSortToObject() {
+ Number.prototype[0] = 5;
+ Number.prototype[1] = 4;
+ Number.prototype.length = 2;
+ x = new Number(0);
+ assertEquals(0, Number(Array.prototype.sort.call(x)));
+ assertEquals(4, x[0]);
+ assertEquals(5, x[1]);
+ assertArrayEquals(["0", "1"], Object.getOwnPropertyNames(x));
+ // The following would throw if ToObject weren't called.
+ assertEquals(0, Number(Array.prototype.sort.call(0)));
+}
+TestSortToObject();