[builtins] Sort only up to a given length in Array.p.sort

Always return the given length (limit) for typed arrays in PrepareElementsForSort
since typed arrays do not have holes.

Bug: v8:6719
Change-Id: Ic455ceca6563fc66a4e4a78c7bf5df1ad17afb4a
Reviewed-on: https://chromium-review.googlesource.com/615104Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51588}

src/runtime/runtime-array.cc

@@ -149,7 +149,8 @@ Object* PrepareElementsForSort(Handle<JSObject> object, uint32_t limit) {
     JSObject::ValidateElements(*object);
   } else if (object->HasFixedTypedArrayElements()) {
     // Typed arrays cannot have holes or undefined elements.
-    return Smi::FromInt(FixedArrayBase::cast(object->elements())->length());
+    int array_length = FixedArrayBase::cast(object->elements())->length();
+    return Smi::FromInt(Min(limit, static_cast<uint32_t>(array_length)));
   } else if (!object->HasDoubleElements()) {
     JSObject::EnsureWritableFastElements(object);
   }

test/mjsunit/array-sort.js

@@ -503,6 +503,19 @@ function TestSortOnNonExtensible() {
 }
 TestSortOnNonExtensible();
 
+function TestSortOnTypedArray() {
+  var array = new Int8Array([10,9,8,7,6,5,4,3,2,1]);
+  Object.defineProperty(array, "length", {value: 5});
+  Array.prototype.sort.call(array);
+  assertEquals(array, new Int8Array([10,6,7,8,9,5,4,3,2,1]));
+
+  var array = new Int8Array([10,9,8,7,6,5,4,3,2,1]);
+  Object.defineProperty(array, "length", {value: 15});
+  Array.prototype.sort.call(array);
+  assertEquals(array, new Int8Array([1,10,2,3,4,5,6,7,8,9]));
+}
+TestSortOnTypedArray();
+
 
 // Test special prototypes
 (function testSortSpecialPrototypes() {