Add ToObject call in Array.prototype.sort

The spec says ToObject is called on the receiver, and this is
observable if you call sort on a primitive. This patch trivially
adds the call and a test.

BUG=v8:4125
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1178193004

Cr-Commit-Position: refs/heads/master@{#28972}

src/array.js

@@ -1176,8 +1176,9 @@ function InnerArraySort(length, comparefn) {
 function ArraySort(comparefn) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.sort");
 
-  var length = TO_UINT32(this.length);
-  return %_CallFunction(this, length, comparefn, InnerArraySort);
+  var array = $toObject(this);
+  var length = TO_UINT32(array.length);
+  return %_CallFunction(array, length, comparefn, InnerArraySort);
 }
 
 

test/mjsunit/array-sort.js

@@ -445,6 +445,22 @@ function TestSortDoesNotDependOnArrayPrototypeSort() {
     fail('Should not call sort');
   };
   sortfn.call(arr);
+  // Restore for the next test
+  Array.prototype.sort = sortfn;
 }
 
 TestSortDoesNotDependOnArrayPrototypeSort();
+
+function TestSortToObject() {
+  Number.prototype[0] = 5;
+  Number.prototype[1] = 4;
+  Number.prototype.length = 2;
+  x = new Number(0);
+  assertEquals(0, Number(Array.prototype.sort.call(x)));
+  assertEquals(4, x[0]);
+  assertEquals(5, x[1]);
+  assertArrayEquals(["0", "1"], Object.getOwnPropertyNames(x));
+  // The following would throw if ToObject weren't called.
+  assertEquals(0, Number(Array.prototype.sort.call(0)));
+}
+TestSortToObject();