Always invoke the default Array.sort functions from builtin functions.

src/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 44 matching lines @@
     } else {
       // The case where key is undefined also ends here.
       if (!IS_UNDEFINED(key)) {
         var e = array[key];
         if (!IS_UNDEFINED(e) || key in array) {
           keys.push(key);
         }
       }
     }
   }
-  keys.sort(function(a, b) { return a - b; });
+  ArraySort.call(keys, function(a, b) { return a - b; });

[Vyacheslav Egorov (Google), 2012/10/19 12:11:51]

What happens here if I overwrite Function.prototype.call to do nasty things?

   return keys;
 }
 
 
 function SparseJoinWithSeparator(array, len, convert, separator) {
   var keys = GetSortedArrayKeys(array, %GetArrayKeys(array, len));
   var totalLength = 0;
   var elements = new InternalArray(keys.length * 2);
   var previousKey = -1;
   for (var i = 0; i < keys.length; i++) {
@@ skipping 1448 matching lines @@
   // exposed to user code.
   // Adding only the functions that are actually used.
   SetUpLockedPrototype(InternalArray, $Array(), $Array(
     "join", getFunction("join", ArrayJoin),
     "pop", getFunction("pop", ArrayPop),
     "push", getFunction("push", ArrayPush)
   ));
 }
 
 SetUpArray();