Throw when a holey property is set in Array.sort

Do not allow that holey properties are defined in Array sort.
Throw a type error if the array is not extensible and there are holey
properties in the middle of the array.

BUG=v8:4888

Review-Url: https://codereview.chromium.org/2664173002
Cr-Commit-Position: refs/heads/master@{#43126}

AUTHORS

@@ -48,6 +48,7 @@ Bert Belder <bertbelder@gmail.com>
 Burcu Dogan <burcujdogan@gmail.com>
 Caitlin Potter <caitpotter88@gmail.com>
 Craig Schlenter <craig.schlenter@gmail.com>
+Choongwoo Han <cwhan.tunz@gmail.com>
 Chris Nardi <hichris123@gmail.com>
 Christopher A. Taylor <chris@gameclosure.com>
 Daniel Andersson <kodandersson@gmail.com>
@@ -64,7 +65,6 @@ Filipe David Manana <fdmanana@gmail.com>
 Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
 Geoffrey Garside <ggarside@gmail.com>
 Gwang Yoon Hwang <ryumiel@company100.net>
-Han Choongwoo <cwhan.tunz@gmail.com>
 Henrique Ferreiro <henrique.ferreiro@gmail.com>
 Hirofumi Mako <mkhrfm@gmail.com>
 Honggyu Kim <honggyu.kp@gmail.com>

src/objects.cc

@@ -16894,7 +16894,7 @@ Handle<Object> JSObject::PrepareSlowElementsForSort(
 Handle<Object> JSObject::PrepareElementsForSort(Handle<JSObject> object,
                                                 uint32_t limit) {
   Isolate* isolate = object->GetIsolate();
-  if (object->HasSloppyArgumentsElements()) {
+  if (object->HasSloppyArgumentsElements() || !object->map()->is_extensible()) {
     return handle(Smi::FromInt(-1), isolate);
   }
 

test/mjsunit/array-sort.js

@@ -480,6 +480,29 @@ function TestSortOnProxy() {
 }
 TestSortOnProxy();
 
+function TestSortOnNonExtensible() {
+  {
+    var arr = [1,,2];
+    Object.preventExtensions(arr);
+    assertThrows(() => arr.sort(), TypeError);
+    assertEquals(arr, [1,,2]);
+  }
+  {
+    var arr = [1,,undefined];
+    Object.preventExtensions(arr);
+    assertThrows(() => arr.sort(), TypeError);
+    assertFalse(arr.hasOwnProperty(1));
+    assertEquals(arr, [1,,undefined]);
+  }
+  {
+    var arr = [1,undefined,2];
+    Object.preventExtensions(arr);
+    arr.sort();
+    assertEquals(arr, [1,2,undefined]);
+  }
+}
+TestSortOnNonExtensible();
+
 
 // Test special prototypes
 (function testSortSpecialPrototypes() {