A bug in Array.prototype.sort

[Georgezxh]

Hermes version: 0.12.0 OS version (if any): ubuntu20.04

Bug Description

The following code should print a sorted array but hermes didn't sort it.

Testcase:

function foo1() {
     foo2.prototype = arguments;
     new foo2();
}
function foo2() {
var x = Array.prototype.sort.call(this);
for (var i = 0; i < x.length; i++) {
    print(x[i]);
    }
}
foo1(3,2,4,1);

Output

3 2 4 1

The Expected Behavior

1 2 3 4

[tmikov]

You are trying to sort an empty object where all the indexed properties belong to the parent. As far as I can tell, our implementation follows ES2020, which treats this as implementation defined. From https://262.ecma-international.org/11.0/#sec-array.prototype.sort:

Let proto be obj.[GetPrototypeOf]. If proto is not null and there exists an integer j such that all of the conditions below are satisfied then the sort order is implementation-defined:

• obj is sparse
• 0 ≤ j < len
• HasProperty(proto, ToString(j)) is true.

Not sure if later versions change the requirements.