From 8b39afdad9a0761e0a5d4af1a762bd9a6daef572 Mon Sep 17 00:00:00 2001
From: Dmitry Volyntsev <xeioex@nginx.com>
Date: Fri, 22 Apr 2022 17:02:28 -0700
Subject: [PATCH] Fixed Array.prototype.sort() when arr size is changed in a
 comparator.

This fixed #468 issue on Github.
---
 src/njs_array.c          | 2 +-
 src/test/njs_unit_test.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/njs_array.c b/src/njs_array.c
index 81a7c155..0b8c7b91 100644
--- a/src/njs_array.c
+++ b/src/njs_array.c
@@ -2696,7 +2696,7 @@ slow_path:
         goto exception;
     }
 
-    if (njs_fast_path(fast_path)) {
+    if (njs_fast_path(fast_path && njs_is_fast_array(this))) {
         array = njs_array(this);
         start = array->start;
 
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 186defa1..25e066c3 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -6989,6 +6989,9 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("[1,2].sort(1)"),
       njs_str("TypeError: comparefn must be callable or undefined") },
 
+    { njs_str("var a = [1,2]; a.sort(() => {a.length = 65535}); a.length"),
+      njs_str("65535") },
+
     /*
       Array.prototype.keys()
       Array.prototype.values()
-- 
2.47.3