Fixed Array.prototype.sort() when arr size is changed in a comparator.

This fixed #468 issue on Github.

diff --git a/src/njs_array.c b/src/njs_array.c
index 81a7c15550efb99e93f89b329ad18a1e32c1f3f4..0b8c7b919787cb10226b2af91f8aed02c3406920 100644 (file)
--- a/src/njs_array.c
+++ b/src/njs_array.c
@@ -2696,7 +2696,7 @@ slow_path:
         goto exception;
     }
 
-    if (njs_fast_path(fast_path)) {
+    if (njs_fast_path(fast_path && njs_is_fast_array(this))) {
         array = njs_array(this);
         start = array->start;
 

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 186defa1afd405d8ae3bd41a484ac1c98584b64f..25e066c3205408922b140d86ba5f863dea36f852 100644 (file)
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -6989,6 +6989,9 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("[1,2].sort(1)"),
       njs_str("TypeError: comparefn must be callable or undefined") },
 
+    { njs_str("var a = [1,2]; a.sort(() => {a.length = 65535}); a.length"),
+      njs_str("65535") },
+
     /*
       Array.prototype.keys()
       Array.prototype.values()