Upgrade to 3.29
Update V8 to 3.29.88.17 and update makefiles to support building on
all the relevant platforms.
Bug: 17370214
Change-Id: Ia3407c157fd8d72a93e23d8318ccaf6ecf77fa4e
diff --git a/test/mjsunit/array-sort.js b/test/mjsunit/array-sort.js
index 3fa623a..6275542 100644
--- a/test/mjsunit/array-sort.js
+++ b/test/mjsunit/array-sort.js
@@ -404,3 +404,47 @@
return a.val - b.val;
}
arr.sort(cmpTest);
+
+function TestSortDoesNotDependOnObjectPrototypeHasOwnProperty() {
+ Array.prototype.sort.call({
+ __proto__: { hasOwnProperty: null, 0: 1 },
+ length: 5
+ });
+
+ var arr = new Array(2);
+ Object.defineProperty(arr, 0, { get: function() {}, set: function() {} });
+ arr.hasOwnProperty = null;
+ arr.sort();
+}
+
+TestSortDoesNotDependOnObjectPrototypeHasOwnProperty();
+
+function TestSortDoesNotDependOnArrayPrototypePush() {
+ // InsertionSort is used for arrays which length <= 22
+ var arr = [];
+ for (var i = 0; i < 22; i++) arr[i] = {};
+ Array.prototype.push = function() {
+ fail('Should not call push');
+ };
+ arr.sort();
+
+ // Quicksort is used for arrays which length > 22
+ // Arrays which length > 1000 guarantee GetThirdIndex is executed
+ arr = [];
+ for (var i = 0; i < 2000; ++i) arr[i] = {};
+ arr.sort();
+}
+
+TestSortDoesNotDependOnArrayPrototypePush();
+
+function TestSortDoesNotDependOnArrayPrototypeSort() {
+ var arr = [];
+ for (var i = 0; i < 2000; i++) arr[i] = {};
+ var sortfn = Array.prototype.sort;
+ Array.prototype.sort = function() {
+ fail('Should not call sort');
+ };
+ sortfn.call(arr);
+}
+
+TestSortDoesNotDependOnArrayPrototypeSort();