https://bugs.webkit.org/show_bug.cgi?id=25477

Reviewed by Oliver Hunt.

Source/JavaScriptCore: 

We're just calling get() to get properties, which is converting missing properties to
undefined. Hole values should be retained, and moved to the end of the array.

* runtime/ArrayPrototype.cpp:
(JSC::getOrHole):
    - Helper function, returns JSValue() instead of undefined for missing properties.
(JSC::arrayProtoFuncSort):
    - Implemented per 15.4.4.11, see comments above.

LayoutTests: 

Added test cases.

* fast/js/array-sort-sparse-expected.txt: Added.
* fast/js/array-sort-sparse.html: Added.
* fast/js/script-tests/array-sort-sparse.js: Added.
(testSort):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129317 268f45cc-cd09-0410-ab3c-d52691b4dbfc