A bug in Array.prototype.sort

[Georgezxh]

Description

Build version: 1.7.14
OS version: ubuntu20.04

I executed the following code and found the result of rhino was different from other js engines' results. It seems like rhino has a reversed result.

Testcase

function foo1() {
  foo2.prototype = arguments;
  new foo2();
}

function foo2() {
  var x = Array.prototype.sort.call(this,foo2);
  for (var i = 0; i < x.length; i++) {
    print(x[i]);
  }
}
foo1(3,2,4,1);

Output

1
4
2
3

Expected behavior

3
2
4
1

[tuchida]

3,2,4,1 in other browsers, but 1,4,2,3 in Rhino.

var a = [3, 2, 4, 1].sort(() => {});
for (var i = 0; i < a.length; i++) {
  console.log(a[i]);
}

ref. #1151
This is probably the cause.

[p-bakker]

@tuchida think we can close this one as well now?

[tuchida]

@p-bakker OK!

js> function foo1() {
  foo2.prototype = arguments;
  new foo2();
}

function foo2() {
  var x = Array.prototype.sort.call(this,foo2);
  for (var i = 0; i < x.length; i++) {
    print(x[i]);
  }
}
foo1(3,2,4,1);
  >   >   > js> js>   >   >   >   >   > js> js> 3
2
4
1

[p-bakker]

Fixed by #1494