Second attempt after bug 1939 to show the assertion in step 7 of SortCompare can be violated in obscure ways.
test case:
---
ta = new (class extends Int8Array {
get length() { return 5 }
static [Symbol.create]() {
return Object.setPrototypeOf(Int8Array[Symbol.create].call(Int8Array), this.prototype);
}
})(0);
ta.sort();
---
(1) %TypedArray%.prototype.sort() uses Get() to retrieve the "length" property instead of [[ArrayLength]], therefore subclasses can provide a different length than [[ArrayLength]].
(2) IntegerIndexedElementGet() returns `undefined` for out-of-bounds integer indexed properties.
By combining (1) and (2) it's possible to get `undefined` values in SortCompare, so the assertion in step 7 fails.
fixed fixed Typed Array sort to use the [[ArrayLength]] internal property and change the description of all other TypedArray methods that share specs with Array prototype methods to say that they also use [[ArrayLength]]
fixed in rev20 editor's draft
fixed in rev20 draft, Oct. 28, 2013