664528 - array.sort bug with arrays containing only undefined values

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
var a = [, , , undefined];
a.sort();
for (var i=0; i<a.length; i++) {
    if (!(i in a)) {
        print("Hole: " + i);
    } else if (a[i] === undefined) {
        print("Undefined: " + i);
    }
}
--
This prints:
--
Hole: 0
Hole: 1
Hole: 2
Undefined: 3
--
This is incorrect. Quoting ES5: "non-­existent property values always compare greater than undefined property values". Works correctly if I add a value other than undefined to the array.

Comment 1

[Jeff Walden [:Waldo]]

Attachment: Patch and test

I happened to notice this in a skim through all JS bugs today, searching for a substring in the summaries.  Having just reviewed bug 715419, this code's super-fresh in memory, so I looked and found the easy fix.  Haven't run JS tests yet, but I'm 99% sure this is a complete fix.

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 713700 [details] [diff] [review]
Patch and test

Review of attachment 713700 [details] [diff] [review]:
-----------------------------------------------------------------

Heh, thanks, completely forgot about this bug.

Comment 3

[Jeff Walden [:Waldo]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a1310b986ebe

Comment 4

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/a1310b986ebe