JS_REENTRANT macro was missing in the sort function.

FillFromPrototype was missing the JS_REENTRANT, fixed that.

lib/Runtime/Library/JavascriptArray.cpp

@@ -6700,7 +6700,7 @@ Case0:
                 {
                     if (sortArray->length > 1)
                     {
-                        sortArray->FillFromPrototypes(0, sortArray->length); // We need find all missing value from [[proto]] object
+                        JS_REENTRANT(jsReentLock, sortArray->FillFromPrototypes(0, sortArray->length)); // We need find all missing value from [[proto]] object
                     }
                     JS_REENTRANT(jsReentLock, sortArray->Sort(compFn));
 

test/Array/bug12340575.js

@@ -0,0 +1,16 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+Object.defineProperty(Array.prototype, 2, {get: function () { } });
+
+var arr = {};
+arr[0] = {};
+arr.length = 10;
+var protoObj = {};
+Object.defineProperty(protoObj, 10, {});
+arr.__proto__ = protoObj;
+
+Array.prototype.sort.call(arr);
+print('Pass');

test/Array/rlexe.xml

@@ -742,4 +742,9 @@
       <files>array_conv_src.js</files>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug12340575.js</files>
+    </default>
+  </test>
 </regress-exe>