From c6ffb07e9f88dc24295ea7c2ec992e02fa61cf5c Mon Sep 17 00:00:00 2001
From: Tooru Fujisawa <arai_a@mac.com>
Date: Thu, 4 Aug 2022 06:41:15 +0000
Subject: [PATCH] Bug 1781061 - Part 1: Add missing callContentFunction in
 sort. r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D153154
---
 js/src/builtin/Array.js                            | 2 +-
 js/src/jit-test/tests/debug/Object-isSameNative.js | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/js/src/builtin/Array.js b/js/src/builtin/Array.js
index 0ad240adf8d51..f62d0077dc10c 100644
--- a/js/src/builtin/Array.js
+++ b/js/src/builtin/Array.js
@@ -121,7 +121,7 @@ function SortArray(obj, comparefn) {
         }
 
         /* Step 4.a. */
-        var v = ToNumber(wrappedCompareFn(x, y));
+        var v = ToNumber(callContentFunction(wrappedCompareFn, undefined, x, y));
 
         /* Step 4.b-c. */
         return v !== v ? 0 : v;
diff --git a/js/src/jit-test/tests/debug/Object-isSameNative.js b/js/src/jit-test/tests/debug/Object-isSameNative.js
index b01b6b4611e6d..0b26144f2159a 100644
--- a/js/src/jit-test/tests/debug/Object-isSameNative.js
+++ b/js/src/jit-test/tests/debug/Object-isSameNative.js
@@ -42,5 +42,8 @@ dbg.onNativeCall = (callee, reason) => {
 for (let i = 0; i < 5; i++) {
   rv.length = 0;
   gdbg.executeInGlobal(`f()`);
-  assertEqArray(rv, ["print", "print", "push", "sort"]);
+  assertEqArray(rv, [
+    "print", "print", "push",
+    "sort", "print", "print",
+  ]);
 }