Fix Array.prototype.sort on proxies.

BUG=chromium:591699
LOG=n
R=rossberg

Review URL: https://codereview.chromium.org/1764953002

Cr-Commit-Position: refs/heads/master@{#34498}

src/runtime/runtime-array.cc

@@ -120,9 +120,11 @@ RUNTIME_FUNCTION(Runtime_PushIfAbsent) {
 RUNTIME_FUNCTION(Runtime_RemoveArrayHoles) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 2);
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
   CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[1]);
-  return *JSObject::PrepareElementsForSort(object, limit);
+  if (object->IsJSProxy()) return Smi::FromInt(-1);
+  return *JSObject::PrepareElementsForSort(Handle<JSObject>::cast(object),
+                                           limit);
 }
 
 

test/mjsunit/array-sort.js

@@ -464,3 +464,9 @@ function TestSortToObject() {
   assertEquals(0, Number(Array.prototype.sort.call(0)));
 }
 TestSortToObject();
+
+function TestSortOnProxy() {
+  var p = new Proxy([2,1,3], {});
+  assertEquals([1,2,3], p.sort());
+}
+TestSortOnProxy();