1583528 - Delete properties in ascending order in js::intrinsic_ArrayNativeSort

Status: RESOLVED FIXED

(Core :: JavaScript: Standard Library, enhancement, P3)

Description

[André Bargull [:anba]]

https://github.com/tc39/ecma262/pull/1585#issuecomment-532994188 shows that V8 and SpiderMonkey behave almost the same except when deleting properties. SpiderMonkey is currently deleting extra properties in descending order whereas V8 deletes them in ascending order. To match the proposed spec changes and to match our self-hosting code, we should remove properties in ascending order.

Relevant code lines:

• js::intrinsic_ArrayNativeSort: https://searchfox.org/mozilla-central/rev/153feabebc2d13bb4c29ef8adf104ec1ebd246ae/js/src/builtin/Array.cpp#2355-2360
• MoveHoles: https://searchfox.org/mozilla-central/rev/153feabebc2d13bb4c29ef8adf104ec1ebd246ae/js/src/builtin/Sorting.js#266-267

---

Test case.

1. Native sort used:

js> new Proxy(new Proxy([, , 0], {}), {deleteProperty(t, pk){ print(`delete ${pk}`); return delete t[pk]; }}).sort()
delete 2
delete 1
[0, , ,]

2. Self-hosted sort used:

js> new Proxy(new Proxy([, , 0], {}), {deleteProperty(t, pk){ print(`delete ${pk}`); return delete t[pk]; }}).sort((a, b) => a < b ? -1 : a > b ? 1 : 0)
delete 1
delete 2
[0, , ,]

Expected: Properties are deleted in the same (= ascending) order.
Actual: Native sort deletes properties in descending order.

Comment 1

[André Bargull [:anba]]

Attachment: Bug 1583528: Delete properties in ascending order in ArrayNativeSort. r=arai!

This ensures our native Array.prototype.sort implementation matches the proposed
semantics in https://github.com/tc39/ecma262/pull/1585. (Our self-hosted
implementation was already deleting the properties in ascending order.)

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6d6e89a6a2bf
Delete properties in ascending order in ArrayNativeSort. r=arai

Comment 3

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/6d6e89a6a2bf