From 9a0197f0c6659e743d806d0f755d4ca7e0ba3138 Mon Sep 17 00:00:00 2001 From: Fabrice Bellard Date: Mon, 26 Oct 2026 12:11:59 +0100 Subject: [PATCH] Write back every element in Array.prototype.sort (theaddonn) --- quickjs.c | 10 +++------- tests/test_builtin.js | 4 ++++ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/quickjs.c b/quickjs.c index 9b5daae..13d2d75 100644 --- a/quickjs.c +++ b/quickjs.c @@ -44884,13 +44884,9 @@ static JSValue js_array_sort(JSContext *ctx, JSValueConst this_val, while (n < pos) { if (array[n].str) JS_FreeValue(ctx, JS_MKPTR(JS_TAG_STRING, array[n].str)); - if (array[n].pos == n) { - JS_FreeValue(ctx, array[n].val); - } else { - if (JS_SetPropertyInt64(ctx, obj, n, array[n].val) < 0) { - n++; - goto exception; - } + if (JS_SetPropertyInt64(ctx, obj, n, array[n].val) < 0) { + n++; + goto exception; } n++; } diff --git a/tests/test_builtin.js b/tests/test_builtin.js index c20d740..a7fb65a 100644 --- a/tests/test_builtin.js +++ b/tests/test_builtin.js @@ -230,6 +230,10 @@ function test_array() err = true; } assert(err && a.toString() === "1,2,3,4"); + + /* sort writes back every element, even those already in place */ + assert_throws(TypeError, () => Array.prototype.sort.call("aa")); + assert_throws(TypeError, () => Object.freeze([1, 2]).sort()); } function test_string() -- 2.47.3