// PTAL: Sorting gone wrong.

var a = [];
a[0] = 'foo';
a[5] = 'doo';
b = a.concat({});
print(b)
b.sort(function(x) { return x; });
print(b);

// Output:
# Compared x64,ignition_turbo with ia32,ignition_turbo
#
# Flags of x64,ignition_turbo:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 1474417455 --ignition-staging --turbo --validate-asm
# Flags of ia32,ignition_turbo:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 1474417455 --ignition-staging --turbo --validate-asm
#
# Difference:
- foo,doo,[object Object],,,,
+ doo,foo,[object Object],,,,
#
# Source file:
none
#
### Start of configuration x64,ignition_turbo:
foo,,,,,doo,[object Object]
foo,doo,[object Object],,,,

### End of configuration x64,ignition_turbo
#
### Start of configuration ia32,ignition_turbo:
foo,,,,,doo,[object Object]
doo,foo,[object Object],,,,

### End of configuration ia32,ignition_turbo

+ clusterfuzz sheriff. Please help find an owner.

Ping, this still repros on ToT.

Both results are technically correct according to the spec IIRC. One (i.e. x64) represents a stabe sorting result, the other (i.e. ia32) is non-stable.

I'll keep that as low prio on my plate. Lets see if we hit it again.

 Issue 698581  has been merged into this issue.

ClusterFuzz testcase 5211430057148416 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

ClusterFuzz has detected this issue as fixed in range 45316:45317.

Detailed report: https://clusterfuzz.com/testcase?key=6085749519941632

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition_turbo:ia32,ignition_turbo
  sources: d91
  
Sanitizer: address (ASAN)

Fixed: V8: 45316:45317

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6085749519941632


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 47306:47307.

Detailed report: https://clusterfuzz.com/testcase?key=6085749519941632

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition_turbo:ia32,ignition_turbo
  sources: d91
  
Sanitizer: address (ASAN)

Fixed: V8: 47306:47307

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6085749519941632

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.