Turns out the Array.prototype.sort polyfill, implemented as a bubble sort, is broken.

Brought to our attention by a Zendesk ticket and easily reproduced in App Lab with the following code:

// Array.sort doesn't work properly
console.log([5, 4, 5, 1].sort());
// Expected: [1,4,5,5]
// Actual  : [4,1,5,5]

The problem is that this Array.prototype.sort polyfill, which uses a bubble sort, is implemented incorrectly:

The exact issue is the if (changes <= 1) break; line. Stepping through the algorithm for the broken case, we can see that we're breaking too early, when only one swap has occurred in the pass but there's still more work to do.

i is 0
  begin 5,4,5,1
  j is 0
    swap 5 and 4
  j is 1
  j is 2
    swap 5 and 1
  end 4,5,1,5
i is 1
  begin 4,5,1,5
  j is 0
  j is 1
    swap 5 and 1
  end 4,1,5,5
[4,1,5,5]

The solution is to check changes < 1 or just !changes. That's what's happened upstream in addition to some other optimizations we should eventually grab, but for now I want a very targeted bugfix.