Bug 604971 - array.sort compare-function gets incorrect this. r=jwalden

js/src/jsarray.cpp

@@ -1905,7 +1905,7 @@ js::array_sort(JSContext *cx, uintN argc, Value *vp)
             }
         } else {
             CompareArgs ca(cx);
-            if (!ca.session.start(cx, fval, NullValue(), 2))
+            if (!ca.session.start(cx, fval, UndefinedValue(), 2))
                 return false;
 
             if (!js_MergeSort(vec, size_t(newlen), sizeof(Value),

js/src/tests/ecma_5/Array/jstests.list

@@ -1,3 +1,4 @@
 url-prefix ../../jsreftest.html?test=ecma_5/Array/
+script sort-01.js
 script toString-01.js
 script toLocaleString-01.js

js/src/tests/ecma_5/Array/sort-01.js

@@ -0,0 +1,23 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 604971;
+var summary = 'array.sort compare-function gets incorrect this';
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+[1, 2, 3].sort(function() { "use strict"; assertEq(this, undefined); });
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("All tests passed!");