bug 300858: Make sure to update all_strings so that we don't try to treat a JSVAL_HOLE as a JSString in sort_compare_strings. Instead, arrays composed of strings and holes should go through sort_compare. r+a=brendan

js/src/jsarray.c

@@ -921,6 +921,7 @@ array_sort(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
             goto out;
         if (!idexists) {
             vec[i] = JSVAL_HOLE;
+            all_strings = JS_FALSE;
             continue;
         }
         newlen++;