From c7b5c9ae82528d2ff16e7bf5faf045dbba84ecd7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=A8=E4=BA=91=E9=A3=9E?= <yangyunfei19@h-partners.com>
Date: Mon, 18 Aug 2025 14:38:00 +0800
Subject: [PATCH] [Bug]: cherry pick !12406 to 5.1.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Issue: https://gitee.com/openharmony/arkcompiler_ets_runtime/issues/ICTFWM?from=project-issue

Signed-off-by: 杨云飞 <yangyunfei19@h-partners.com>
---
 ecmascript/js_stable_array.cpp              | 6 +++---
 ecmascript/js_stable_array.h                | 2 +-
 test/moduletest/arraysort/arraysort.js      | 8 ++++++++
 test/moduletest/arraysort/expect_output.txt | 1 +
 4 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/ecmascript/js_stable_array.cpp b/ecmascript/js_stable_array.cpp
index 56a400f49c..07e1f73eb9 100644
--- a/ecmascript/js_stable_array.cpp
+++ b/ecmascript/js_stable_array.cpp
@@ -1745,7 +1745,7 @@ JSHandle<TaggedArray> JSStableArray::SortIndexedProperties(JSThread *thread, con
 }
 
 JSTaggedValue JSStableArray::CopySortedListToReceiver(JSThread *thread, const JSHandle<JSTaggedValue> &thisObjVal,
-                                                      JSHandle<TaggedArray> sortedList, uint32_t len)
+                                                      JSHandle<TaggedArray> sortedList)
 {
     // 6. Let itemCount be the number of elements in sortedList.
     uint32_t itemCount = sortedList->GetLength();
@@ -1774,7 +1774,7 @@ JSTaggedValue JSStableArray::CopySortedListToReceiver(JSThread *thread, const JS
     //       a. Perform ? DeletePropertyOrThrow(obj, ! ToString((j))).
     //       b. Set j to j + 1.
     valueHandle.Update(JSTaggedValue::Hole());
-    for (uint32_t j = itemCount; j < len; j++) {
+    for (uint32_t j = itemCount; j < newLength; j++) {
         ElementAccessor::Set(thread, thisObj, j, valueHandle, needTransition);
     }
     JSHandle<JSArray>::Cast(thisObj)->SetArrayLength(thread, newLength);
@@ -1800,7 +1800,7 @@ JSTaggedValue JSStableArray::Sort(JSThread *thread, const JSHandle<JSTaggedValue
         thread, thisObjVal, len, callbackFnHandle, base::HolesType::SKIP_HOLES);
     RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread);
     if (thisObjVal->IsStableJSArray(thread)) {
-        CopySortedListToReceiver(thread, thisObjVal, sortedList, len);
+        CopySortedListToReceiver(thread, thisObjVal, sortedList);
     } else {
         JSArray::CopySortedListToReceiver(thread, thisObjVal, sortedList, len);
         RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread);
diff --git a/ecmascript/js_stable_array.h b/ecmascript/js_stable_array.h
index fc9d9a5fbe..2e0dd30d24 100644
--- a/ecmascript/js_stable_array.h
+++ b/ecmascript/js_stable_array.h
@@ -114,7 +114,7 @@ public:
     static JSTaggedValue Sort(JSThread *thread, const JSHandle<JSTaggedValue> &thisObjVal,
                               const JSHandle<JSTaggedValue> &callbackFnHandle);
     static JSTaggedValue CopySortedListToReceiver(JSThread *thread, const JSHandle<JSTaggedValue> &thisObjVal,
-                                                  JSHandle<TaggedArray> sortedList, uint32_t len);
+                                                  JSHandle<TaggedArray> sortedList);
     static JSTaggedValue Fill(JSThread *thread, const JSHandle<JSObject> &thisObj,
                               const JSHandle<JSTaggedValue> &value,
                               int64_t start, int64_t end);
diff --git a/test/moduletest/arraysort/arraysort.js b/test/moduletest/arraysort/arraysort.js
index 9eabf8b60c..4119c6b527 100644
--- a/test/moduletest/arraysort/arraysort.js
+++ b/test/moduletest/arraysort/arraysort.js
@@ -846,3 +846,11 @@ print(sortNumber7[6]);
     print(arr.toSorted());
     print("---------------test for string array sort end-----------------------------")
 }
+
+{
+    let arr = [0, , 1];
+    arr.sort((v1, v2) => {
+        arr.shift();
+    });
+    print("test for array sort with shift Success!");
+}
diff --git a/test/moduletest/arraysort/expect_output.txt b/test/moduletest/arraysort/expect_output.txt
index 9d5f1a5d9d..22533304ff 100644
--- a/test/moduletest/arraysort/expect_output.txt
+++ b/test/moduletest/arraysort/expect_output.txt
@@ -119,3 +119,4 @@ Fri Dec 13 2019 14:48:00 GMT+0800,Sat Dec 14 2019 14:48:00 GMT+0800,Thu Dec 12 2
 ---------------test for string array sort---------------------------------
 a,aa,ab,aba,abb,abc,ac,b,c
 ---------------test for string array sort end-----------------------------
+test for array sort with shift Success!
-- 
Gitee