Bug 614915: set return value correctly when sorting a list containing only undefined values, r=cdleary
authorDavid Mandelin <dmandelin@mozilla.com>
Tue, 30 Nov 2010 10:25:07 -0800
changeset 58691 67dd268276f30e23806ebbec85559155eda17d91
parent 58690 8c5f62e68881bbcc0530f3b6c5b6d67052086f5a
child 58692 322c34dc7c285b5ac4b917daa1b4f4e48f48cfd2
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewerscdleary
bugs614915
milestone2.0b8pre
Bug 614915: set return value correctly when sorting a list containing only undefined values, r=cdleary
js/src/jit-test/tests/basic/bug614915.js
js/src/jsarray.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug614915.js
@@ -0,0 +1,2 @@
+var s = [undefined, undefined].sort();
+assertEq(s.length, 2);
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1838,18 +1838,20 @@ js::array_sort(JSContext *cx, uintN argc
                 continue;
             }
 
             allStrings = allStrings && vec[newlen].isString();
 
             ++newlen;
         }
 
-        if (newlen == 0)
+        if (newlen == 0) {
+            vp->setObject(*obj);
             return true; /* The array has only holes and undefs. */
+        }
 
         /*
          * The first newlen elements of vec are copied from the array object
          * (above). The remaining newlen positions are used as GC-rooted scratch
          * space for mergesort. We must clear the space before including it to
          * the root set covered by tvr.count.
          */
         Value *mergesort_tmp = vec + newlen;