Bug 188382

Summary: Array.prototype.sort should throw TypeError if param is a not callable object
Product: WebKit Reporter: isol2
Component: JavaScriptCoreAssignee: Keith Miller <keith_miller>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, darin, ews-watchlist, fpizlo, joepeck, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: Safari 11   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Description isol2 2018-08-07 11:50:19 PDT 
Hi everyone,

According to ES specification (https://tc39.github.io/ecma262/#sec-array.prototype.sort) Array.sort param should be a comparefn or undefined value, otherwise 
should throw a TypeError.

steps to reproduce:

var obj = {};
var arr = [];
arr.sort(obj);
arr.sort(obj, obj);

Actual results:
pass without failures

Expected results:
TypeError: The comparison function must be either a function or undefined


V8, Chakra and Spidermonkey works as expected.
Comment 1 isol2 2018-08-07 11:51:15 PDT 
OS: Ubuntu 16.04 x64
jsc version: 234654

cinfuzz
Comment 2 Keith Miller 2018-08-08 19:04:47 PDT 
Created attachment 346811 [details]
Patch
Comment 3 WebKit Commit Bot 2018-08-08 20:13:27 PDT 
Comment on attachment 346811 [details]
Patch

Clearing flags on attachment: 346811

Committed r234716: <https://trac.webkit.org/changeset/234716>
Comment 4 WebKit Commit Bot 2018-08-08 20:13:28 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 5 Radar WebKit Bug Importer 2018-08-08 20:14:18 PDT 
<rdar://problem/43077213>
Comment 6 Darin Adler 2018-08-19 13:00:28 PDT 
Comment on attachment 346811 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=346811&action=review

> Source/JavaScriptCore/builtins/ArrayPrototype.js:602
> +        @throwTypeError("Array.prototype.sort requires the comparsion function be a function or undefined");

Might also want to fix the typo here: both before and after this patch it says "comparsion" rather than "comparison".