22.1.3.24 Array.prototype.sort (comparefn)
> Within this specification of the sort method, an Array object, obj, is said to be sparse [...]
But later "sparse" is also used for non-Array objects. If sparse is extended to non-Array objects, ToUint32 needs to be changed to ToLength.
> The sort order is the ordering of the array index property values of obj after completion of this function.
Per 6.1.7 The Object Type, third paragraph:
> An array index is an integer index whose numeric value i is in the range +0 ≤ i < 2^32-1.
But the sort method sorts all integer indexed properties < 2^53-1, that means property keys beyond the array index limit.
Similar issue in:
> Any array index property of obj whose name is a nonnegative integer less than len is a data
> property whose [[Configurable]] attribute is false.
And:
> If any array index property of obj whose name is a nonnegative integer less than len is an
> accessor property or is a data property whose [[Writable]] attribute is false.
fixed in rev37 editor's draft
replaces uses of "array index" within sort with "integer index"
made the definition of sparse dependent upon len value.
Since that definition of "sparse" is only for use within the sort method, the other uses of "sparse" (all within typed array section) can be interpreted using the conventional technical meaning of the term. (If I had more time, I might get more explicit about that, but I don't think it is likely to cause confusion)
In Rev37