From 034fc6a4c9ea9f751c63232acba7c1e6ffd4c14e Mon Sep 17 00:00:00 2001
From: Pale Moon <git-repo@palemoon.org>
Date: Sun, 19 Mar 2017 09:29:39 +0100
Subject: [PATCH] Revert "Be more careful about optimizing sorted arrays."

This reverts commit a8a31880a42f5283f30c6f670ce7da8940fe43a3.
This resolves #966
---
 js/src/jsarray.cpp | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index cc0c79fc98..3fbb2dc062 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1933,7 +1933,6 @@ js::array_sort(JSContext* cx, unsigned argc, Value* vp)
         undefs = 0;
         bool allStrings = true;
         bool allInts = true;
-        bool extraIndexed = ObjectMayHaveExtraIndexedProperties(obj);
         RootedValue v(cx);
         for (uint32_t i = 0; i < len; i++) {
             if (!CheckForInterrupt(cx))
@@ -1966,9 +1965,7 @@ js::array_sort(JSContext* cx, unsigned argc, Value* vp)
         }
 
         /* Here len == n + undefs + number_of_holes. */
-        bool defaultOrMatch;
         if (fval.isNull()) {
-            defaultOrMatch = true;
             /*
              * Sort using the default comparator converting all elements to
              * strings.
@@ -1992,7 +1989,6 @@ js::array_sort(JSContext* cx, unsigned argc, Value* vp)
             if (comp == Match_Failure)
                 return false;
 
-            defaultOrMatch = comp != Match_None;
             if (comp != Match_None) {
                 if (allInts) {
                     JS_ALWAYS_TRUE(vec.resize(n * 2));
@@ -2013,10 +2009,7 @@ js::array_sort(JSContext* cx, unsigned argc, Value* vp)
             }
         }
 
-        ShouldUpdateTypes updateTypes = !extraIndexed && (allStrings || allInts) && defaultOrMatch
-                                        ? ShouldUpdateTypes::DontUpdateTypes
-                                        : ShouldUpdateTypes::UpdateTypes;
-        if (!InitArrayElements(cx, obj, 0, uint32_t(n), vec.begin(), updateTypes))
+        if (!InitArrayElements(cx, obj, 0, uint32_t(n), vec.begin(), DontUpdateTypes))
             return false;
     }