BUG: Array prototype values copied to non-array when using sort

[rhuanjl]

Note I am intending to fix this bug as part of the pull request I'm working on to implement a stable array sort.

Opening this issue as a reminder/record and also in case my upcoming pull request can't be accepted for some reason.

With the current Array.prototype.sort method in ChakraCore if an array-like object with missing properties has the sort method called on it ChakraCore will fill the holes by copying from the array prototype if it has applicable values on it.

Including if the array-like object is not an instance of Array and does not inherit from the array prototype.

Array.prototype[1] = 321;

var o = {};
o[0] = 10;
o.length = 3;
o.sort = Array.prototype.sort;
o.join = Array.prototype.join;
o.toString = Array.prototype.toString;

print (o.sort().toString());

eshost output:

#### ChakraCore v1.11
10,321,

#### SpiderMonkey
10,,

#### ChakraCore master
10,321,

#### V8 --harmony
10,,

#### JavaScriptCore
10,,

Additionally this incorrect behaviour is currently tested in es5/defineIndexProperty.js as test_321_i.