Bug 1781061 - Part 1: Add missing callContentFunction in sort. r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D153154
dothq · Aug 4, 2022 · c6ffb07 · c6ffb07
1 parent 2b6cd60
commit c6ffb07
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/js/src/builtin/Array.js b/js/src/builtin/Array.js
@@ -121,7 +121,7 @@ function SortArray(obj, comparefn) {
         }
 
         /* Step 4.a. */
-        var v = ToNumber(wrappedCompareFn(x, y));
+        var v = ToNumber(callContentFunction(wrappedCompareFn, undefined, x, y));
 
         /* Step 4.b-c. */
         return v !== v ? 0 : v;

diff --git a/js/src/jit-test/tests/debug/Object-isSameNative.js b/js/src/jit-test/tests/debug/Object-isSameNative.js
@@ -42,5 +42,8 @@ dbg.onNativeCall = (callee, reason) => {
 for (let i = 0; i < 5; i++) {
   rv.length = 0;
   gdbg.executeInGlobal(`f()`);
-  assertEqArray(rv, ["print", "print", "push", "sort"]);
+  assertEqArray(rv, [
+    "print", "print", "push",
+    "sort", "print", "print",
+  ]);
 }