Write back every element in Array.prototype.sort (theaddonn)

diff --git a/quickjs.c b/quickjs.c
index 9b5daae1ffd9c8c78e4c97bfe5d712f447499524..13d2d756dbcfbb288d3fc5dbb62af053aee814e6 100644 (file)
--- a/quickjs.c
+++ b/quickjs.c
@@ -44884,13 +44884,9 @@ static JSValue js_array_sort(JSContext *ctx, JSValueConst this_val,
     while (n < pos) {
         if (array[n].str)
             JS_FreeValue(ctx, JS_MKPTR(JS_TAG_STRING, array[n].str));
-        if (array[n].pos == n) {
-            JS_FreeValue(ctx, array[n].val);
-        } else {
-            if (JS_SetPropertyInt64(ctx, obj, n, array[n].val) < 0) {
-                n++;
-                goto exception;
-            }
+        if (JS_SetPropertyInt64(ctx, obj, n, array[n].val) < 0) {
+            n++;
+            goto exception;
         }
         n++;
     }

diff --git a/tests/test_builtin.js b/tests/test_builtin.js
index c20d740c6709d0aeb1a1bdee160eec5df6f20599..a7fb65a32c97377b92266e03022a62dcb58fcb96 100644 (file)
--- a/tests/test_builtin.js
+++ b/tests/test_builtin.js
@@ -230,6 +230,10 @@ function test_array()
         err = true;
     }
     assert(err && a.toString() === "1,2,3,4");
+
+    /* sort writes back every element, even those already in place */
+    assert_throws(TypeError, () => Array.prototype.sort.call("aa"));
+    assert_throws(TypeError, () => Object.freeze([1, 2]).sort());
 }
 
 function test_string()