<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>25477</bug_id>
          
          <creation_ts>2009-04-29 23:57:01 -0700</creation_ts>
          <short_desc>[ES5] Sorting a non-array creates propreties (spec-violation)</short_desc>
          <delta_ts>2012-09-23 22:34:23 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Minor</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Lasse Reichstein Holst Nielsen">lrn</reporter>
          <assigned_to name="Gavin Barraclough">barraclough</assigned_to>
          <cc>ap</cc>
    
    <cc>barraclough</cc>
    
    <cc>ggaren</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>119434</commentid>
    <comment_count>0</comment_count>
    <who name="Lasse Reichstein Holst Nielsen">lrn</who>
    <bug_when>2009-04-29 23:57:01 -0700</bug_when>
    <thetext>Sorting a sparse non-array object will create properties with the value &quot;undefined&quot; instead of deleting existing properties.

Example:
 [].sort.call({length:5,2:42}).hasOwnProperty(2)
The resulting object has the form {length:5, 0:42, 2:undefined}. According to the specification, the &quot;2&quot; property should not exist.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>119582</commentid>
    <comment_count>1</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2009-05-01 03:51:56 -0700</bug_when>
    <thetext>Do we also disagree with IE and/or Firefox here?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>119584</commentid>
    <comment_count>2</comment_count>
    <who name="Lasse Reichstein Holst Nielsen">lrn</who>
    <bug_when>2009-05-01 04:38:57 -0700</bug_when>
    <thetext>IE 7 and Firefox 3.08 both give &quot;false&quot; on the example expression (the expected result), where JSC gives &quot;true&quot;.
It is probably an articfact of the handling of objects with inherited array indices in Array.prototype.sort.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>726247</commentid>
    <comment_count>3</comment_count>
      <attachid>165283</attachid>
    <who name="Gavin Barraclough">barraclough</who>
    <bug_when>2012-09-23 00:10:49 -0700</bug_when>
    <thetext>Created attachment 165283
Fix</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>726248</commentid>
    <comment_count>4</comment_count>
      <attachid>165283</attachid>
    <who name="Sam Weinig">sam</who>
    <bug_when>2012-09-23 00:13:12 -0700</bug_when>
    <thetext>Comment on attachment 165283
Fix

Tests?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>726282</commentid>
    <comment_count>5</comment_count>
      <attachid>165283</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2012-09-23 12:04:14 -0700</bug_when>
    <thetext>Comment on attachment 165283
Fix

r+ but are we repeatedly retrieving the methodTable?  It seems like we could retrieve it just once and be done...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>726299</commentid>
    <comment_count>6</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2012-09-23 15:00:52 -0700</bug_when>
    <thetext>/me agrees with Sam Weinig.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>726300</commentid>
    <comment_count>7</comment_count>
    <who name="Gavin Barraclough">barraclough</who>
    <bug_when>2012-09-23 15:29:12 -0700</bug_when>
    <thetext>(In reply to comment #5)
&gt; (From update of attachment 165283 [details])
&gt; r+ but are we repeatedly retrieving the methodTable?  It seems like we could retrieve it just once and be done...

Ugh, I&apos;m going to ignore that. :-)

(1) It goes against the direction I&apos;d like us to go for methodTable() access - we should be able to add wrappers to JSCell that automatically call via the method table, to avoid the code duplication everywhere.
(2) That may not matter – the C compiler may alias the loads.  We should only manually fold the methodTable() accesses if profiling indicates this is important.
(3) This is array::sort applied to a non-array object – if performance matters we should throw away the internet and start again. :-)

You&apos;re right, might be a useful optimization in some places – I hope not though.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>726301</commentid>
    <comment_count>8</comment_count>
    <who name="Gavin Barraclough">barraclough</who>
    <bug_when>2012-09-23 15:29:49 -0700</bug_when>
    <thetext>(In reply to comment #4)
&gt; (From update of attachment 165283 [details])
&gt; Tests?

Ooops, I did add a couple of tests, they seem not to be in the patch I added.  Oh well, they&apos;ll be there when I land. :-)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>726389</commentid>
    <comment_count>9</comment_count>
    <who name="Gavin Barraclough">barraclough</who>
    <bug_when>2012-09-23 22:34:23 -0700</bug_when>
    <thetext>Fixed in r129317</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>165283</attachid>
            <date>2012-09-23 00:10:49 -0700</date>
            <delta_ts>2012-09-23 12:04:14 -0700</delta_ts>
            <desc>Fix</desc>
            <filename>25477.patch</filename>
            <type>text/plain</type>
            <size>4296</size>
            <attacher name="Gavin Barraclough">barraclough</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTI5MzE0KQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBA
CisyMDEyLTA5LTIzICBHYXZpbiBCYXJyYWNsb3VnaCAgPGJhcnJhY2xvdWdoQGFwcGxlLmNvbT4K
KworICAgICAgICBTb3J0aW5nIGEgbm9uLWFycmF5IGNyZWF0ZXMgcHJvcHJldGllcyAoc3BlYy12
aW9sYXRpb24pCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p
ZD0yNTQ3NworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg
IFdlJ3JlIGp1c3QgY2FsbGluZyBnZXQoKSB0byBnZXQgcHJvcGVydGllcywgd2hpY2ggaXMgY29u
dmVydGluZyBtaXNzaW5nIHByb3BlcnRpZXMgdG8KKyAgICAgICAgdW5kZWZpbmVkLiBIb2xlIHZh
bHVlcyBzaG91bGQgYmUgcmV0YWluZWQsIGFuZCBtb3ZlZCB0byB0aGUgZW5kIG9mIHRoZSBhcnJh
eS4KKworICAgICAgICAqIHJ1bnRpbWUvQXJyYXlQcm90b3R5cGUuY3BwOgorICAgICAgICAoSlND
OjpnZXRPckhvbGUpOgorICAgICAgICAgICAgLSBIZWxwZXIgZnVuY3Rpb24sIHJldHVybnMgSlNW
YWx1ZSgpIGluc3RlYWQgb2YgdW5kZWZpbmVkIGZvciBtaXNzaW5nIHByb3BlcnRpZXMuCisgICAg
ICAgIChKU0M6OmFycmF5UHJvdG9GdW5jU29ydCk6CisgICAgICAgICAgICAtIEltcGxlbWVudGVk
IHBlciAxNS40LjQuMTEsIHNlZSBjb21tZW50cyBhYm92ZS4KKwogMjAxMi0wOS0yMSAgR2VvZmZy
ZXkgR2FyZW4gIDxnZ2FyZW5AYXBwbGUuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQsIHJvbGxl
ZCBvdXQgYSBsaW5lIEkgY29tbWl0dGVkIGJ5IGFjY2lkZW50LgpJbmRleDogU291cmNlL0phdmFT
Y3JpcHRDb3JlL3J1bnRpbWUvQXJyYXlQcm90b3R5cGUuY3BwCj09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJj
ZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0FycmF5UHJvdG90eXBlLmNwcAkocmV2aXNpb24gMTI5
MzA5KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQXJyYXlQcm90b3R5cGUuY3Bw
CSh3b3JraW5nIGNvcHkpCkBAIC02MjksNiArNjI5LDE1IEBAIEVuY29kZWRKU1ZhbHVlIEpTQ19I
T1NUX0NBTEwgYXJyYXlQcm90b0YKICAgICByZXR1cm4gSlNWYWx1ZTo6ZW5jb2RlKHJlc3VsdCk7
CiB9CiAKK2lubGluZSBKU1ZhbHVlIGdldE9ySG9sZShKU09iamVjdCogb2JqLCBFeGVjU3RhdGUq
IGV4ZWMsIHVuc2lnbmVkIHByb3BlcnR5TmFtZSkKK3sKKyAgICBQcm9wZXJ0eVNsb3Qgc2xvdChv
YmopOworICAgIGlmIChvYmotPmdldFByb3BlcnR5U2xvdChleGVjLCBwcm9wZXJ0eU5hbWUsIHNs
b3QpKQorICAgICAgICByZXR1cm4gc2xvdC5nZXRWYWx1ZShleGVjLCBwcm9wZXJ0eU5hbWUpOwor
CisgICAgcmV0dXJuIEpTVmFsdWUoKTsKK30KKwogRW5jb2RlZEpTVmFsdWUgSlNDX0hPU1RfQ0FM
TCBhcnJheVByb3RvRnVuY1NvcnQoRXhlY1N0YXRlKiBleGVjKQogewogICAgIEpTT2JqZWN0KiB0
aGlzT2JqID0gZXhlYy0+aG9zdFRoaXNWYWx1ZSgpLnRvT2JqZWN0KGV4ZWMpOwpAQCAtNjUzLDE3
ICs2NjIsMjEgQEAgRW5jb2RlZEpTVmFsdWUgSlNDX0hPU1RfQ0FMTCBhcnJheVByb3RvRgogICAg
IC8vICJNaW4iIHNvcnQuIE5vdCB0aGUgZmFzdGVzdCwgYnV0IGRlZmluaXRlbHkgbGVzcyBjb2Rl
IHRoYW4gaGVhcHNvcnQKICAgICAvLyBvciBxdWlja3NvcnQsIGFuZCBtdWNoIGxlc3Mgc3dhcHBp
bmcgdGhhbiBidWJibGVzb3J0L2luc2VydGlvbnNvcnQuCiAgICAgZm9yICh1bnNpZ25lZCBpID0g
MDsgaSA8IGxlbmd0aCAtIDE7ICsraSkgewotICAgICAgICBKU1ZhbHVlIGlPYmogPSB0aGlzT2Jq
LT5nZXQoZXhlYywgaSk7CisgICAgICAgIEpTVmFsdWUgaU9iaiA9IGdldE9ySG9sZSh0aGlzT2Jq
LCBleGVjLCBpKTsKICAgICAgICAgaWYgKGV4ZWMtPmhhZEV4Y2VwdGlvbigpKQogICAgICAgICAg
ICAgcmV0dXJuIEpTVmFsdWU6OmVuY29kZShqc1VuZGVmaW5lZCgpKTsKICAgICAgICAgdW5zaWdu
ZWQgdGhlbWluID0gaTsKICAgICAgICAgSlNWYWx1ZSBtaW5PYmogPSBpT2JqOwogICAgICAgICBm
b3IgKHVuc2lnbmVkIGogPSBpICsgMTsgaiA8IGxlbmd0aDsgKytqKSB7Ci0gICAgICAgICAgICBK
U1ZhbHVlIGpPYmogPSB0aGlzT2JqLT5nZXQoZXhlYywgaik7CisgICAgICAgICAgICBKU1ZhbHVl
IGpPYmogPSBnZXRPckhvbGUodGhpc09iaiwgZXhlYywgaik7CiAgICAgICAgICAgICBpZiAoZXhl
Yy0+aGFkRXhjZXB0aW9uKCkpCiAgICAgICAgICAgICAgICAgcmV0dXJuIEpTVmFsdWU6OmVuY29k
ZShqc1VuZGVmaW5lZCgpKTsKICAgICAgICAgICAgIGRvdWJsZSBjb21wYXJlUmVzdWx0OwotICAg
ICAgICAgICAgaWYgKGpPYmouaXNVbmRlZmluZWQoKSkKKyAgICAgICAgICAgIGlmICghak9iaikK
KyAgICAgICAgICAgICAgICBjb21wYXJlUmVzdWx0ID0gMTsKKyAgICAgICAgICAgIGVsc2UgaWYg
KCFtaW5PYmopCisgICAgICAgICAgICAgICAgY29tcGFyZVJlc3VsdCA9IC0xOworICAgICAgICAg
ICAgZWxzZSBpZiAoak9iai5pc1VuZGVmaW5lZCgpKQogICAgICAgICAgICAgICAgIGNvbXBhcmVS
ZXN1bHQgPSAxOyAvLyBkb24ndCBjaGVjayBtaW5PYmogYmVjYXVzZSB0aGVyZSdzIG5vIG5lZWQg
dG8gZGlmZmVyZW50aWF0ZSA9PSAoMCkgZnJvbSA+ICgxKQogICAgICAgICAgICAgZWxzZSBpZiAo
bWluT2JqLmlzVW5kZWZpbmVkKCkpCiAgICAgICAgICAgICAgICAgY29tcGFyZVJlc3VsdCA9IC0x
OwpAQCAtNjgyLDEyICs2OTUsMjIgQEAgRW5jb2RlZEpTVmFsdWUgSlNDX0hPU1RfQ0FMTCBhcnJh
eVByb3RvRgogICAgICAgICB9CiAgICAgICAgIC8vIFN3YXAgdGhlbWluIGFuZCBpCiAgICAgICAg
IGlmICh0aGVtaW4gPiBpKSB7Ci0gICAgICAgICAgICB0aGlzT2JqLT5tZXRob2RUYWJsZSgpLT5w
dXRCeUluZGV4KHRoaXNPYmosIGV4ZWMsIGksIG1pbk9iaiwgdHJ1ZSk7Ci0gICAgICAgICAgICBp
ZiAoZXhlYy0+aGFkRXhjZXB0aW9uKCkpCisgICAgICAgICAgICBpZiAobWluT2JqKSB7CisgICAg
ICAgICAgICAgICAgdGhpc09iai0+bWV0aG9kVGFibGUoKS0+cHV0QnlJbmRleCh0aGlzT2JqLCBl
eGVjLCBpLCBtaW5PYmosIHRydWUpOworICAgICAgICAgICAgICAgIGlmIChleGVjLT5oYWRFeGNl
cHRpb24oKSkKKyAgICAgICAgICAgICAgICAgICAgcmV0dXJuIEpTVmFsdWU6OmVuY29kZShqc1Vu
ZGVmaW5lZCgpKTsKKyAgICAgICAgICAgIH0gZWxzZSBpZiAoIXRoaXNPYmotPm1ldGhvZFRhYmxl
KCktPmRlbGV0ZVByb3BlcnR5QnlJbmRleCh0aGlzT2JqLCBleGVjLCBpKSkgeworICAgICAgICAg
ICAgICAgIHRocm93VHlwZUVycm9yKGV4ZWMsICJVbmFibGUgdG8gZGVsZXRlIHByb3BlcnR5LiIp
OwogICAgICAgICAgICAgICAgIHJldHVybiBKU1ZhbHVlOjplbmNvZGUoanNVbmRlZmluZWQoKSk7
Ci0gICAgICAgICAgICB0aGlzT2JqLT5tZXRob2RUYWJsZSgpLT5wdXRCeUluZGV4KHRoaXNPYmos
IGV4ZWMsIHRoZW1pbiwgaU9iaiwgdHJ1ZSk7Ci0gICAgICAgICAgICBpZiAoZXhlYy0+aGFkRXhj
ZXB0aW9uKCkpCisgICAgICAgICAgICB9CisgICAgICAgICAgICBpZiAoaU9iaikgeworICAgICAg
ICAgICAgICAgIHRoaXNPYmotPm1ldGhvZFRhYmxlKCktPnB1dEJ5SW5kZXgodGhpc09iaiwgZXhl
YywgdGhlbWluLCBpT2JqLCB0cnVlKTsKKyAgICAgICAgICAgICAgICBpZiAoZXhlYy0+aGFkRXhj
ZXB0aW9uKCkpCisgICAgICAgICAgICAgICAgICAgIHJldHVybiBKU1ZhbHVlOjplbmNvZGUoanNV
bmRlZmluZWQoKSk7CisgICAgICAgICAgICB9IGVsc2UgaWYgKCF0aGlzT2JqLT5tZXRob2RUYWJs
ZSgpLT5kZWxldGVQcm9wZXJ0eUJ5SW5kZXgodGhpc09iaiwgZXhlYywgdGhlbWluKSkgeworICAg
ICAgICAgICAgICAgIHRocm93VHlwZUVycm9yKGV4ZWMsICJVbmFibGUgdG8gZGVsZXRlIHByb3Bl
cnR5LiIpOwogICAgICAgICAgICAgICAgIHJldHVybiBKU1ZhbHVlOjplbmNvZGUoanNVbmRlZmlu
ZWQoKSk7CisgICAgICAgICAgICB9CiAgICAgICAgIH0KICAgICB9CiAgICAgcmV0dXJuIEpTVmFs
dWU6OmVuY29kZSh0aGlzT2JqKTsK
</data>
<flag name="review"
          id="177289"
          type_id="1"
          status="+"
          setter="oliver"
    />
          </attachment>
      

    </bug>

</bugzilla>