[java/cs] Bound array accesses on quicksort to lo/hi. Closes #3822

std/cs/_std/Array.hx

@@ -238,23 +238,23 @@ import cs.NativeArray;
 
 	private function quicksort( lo : Int, hi : Int, f : T -> T -> Int ) : Void
 	{
-        var buf = __a;
+		var buf = __a;
 		var i = lo, j = hi;
-        var p = buf[(i + j) >> 1];
+		var p = buf[(i + j) >> 1];
 		while ( i <= j )
 		{
-			while ( f(buf[i], p) < 0 ) i++;
-            while ( f(buf[j], p) > 0 ) j--;
+			while ( i < hi && f(buf[i], p) < 0 ) i++;
+			while ( j > lo && f(buf[j], p) > 0 ) j--;
 			if ( i <= j )
 			{
-                var t = buf[i];
-                buf[i++] = buf[j];
-                buf[j--] = t;
-            }
+				var t = buf[i];
+				buf[i++] = buf[j];
+				buf[j--] = t;
+			}
 		}
 
 		if( lo < j ) quicksort( lo, j, f );
-        if( i < hi ) quicksort( i, hi, f );
+		if( i < hi ) quicksort( i, hi, f );
 	}
 
 	public function splice( pos : Int, len : Int ) : Array<T>

std/java/_std/Array.hx

@@ -201,23 +201,23 @@ import java.NativeArray;
 
 	private function quicksort( lo : Int, hi : Int, f : T -> T -> Int ) : Void
 	{
-        var buf = __a;
+		var buf = __a;
 		var i = lo, j = hi;
-        var p = buf[(i + j) >> 1];
+		var p = buf[(i + j) >> 1];
 		while ( i <= j )
 		{
-			while ( f(buf[i], p) < 0 ) i++;
-            while ( f(buf[j], p) > 0 ) j--;
+			while ( i < hi && f(buf[i], p) < 0 ) i++;
+			while ( j > lo && f(buf[j], p) > 0 ) j--;
 			if ( i <= j )
 			{
-                var t = buf[i];
-                buf[i++] = buf[j];
-                buf[j--] = t;
-            }
+				var t = buf[i];
+				buf[i++] = buf[j];
+				buf[j--] = t;
+			}
 		}
 
 		if( lo < j ) quicksort( lo, j, f );
-        if( i < hi ) quicksort( i, hi, f );
+		if( i < hi ) quicksort( i, hi, f );
 	}
 
 	public function splice( pos : Int, len : Int ) : Array<T>

tests/unit/src/unit/issues/Issue3822.hx

@@ -0,0 +1,25 @@
+package unit.issues;
+
+class Issue3822 extends Test
+{
+	public function test()
+	{
+		var arr = [2,1,0];
+		arr.sort(function(_,_) return 1);
+		arr.sort(function(_,_) return -1);
+		arr.sort(Reflect.compare);
+		eq(arr.toString(),'[0,1,2]');
+
+		arr = [2,1,0,4,6,65,4,3,6,7,8,2];
+		arr.sort(function(_,_) return 1);
+		arr.sort(function(_,_) return -1);
+		arr.sort(Reflect.compare);
+		eq(arr.toString(),'[0,1,2,2,3,4,4,6,6,7,8,65]');
+
+		arr = [2,1,0,4,6,10,3,6,7,8,2];
+		arr.sort(function(_,_) return 1);
+		arr.sort(function(_,_) return -1);
+		arr.sort(Reflect.compare);
+		eq(arr.toString(),'[0,1,2,2,3,4,6,6,7,8,10]');
+	}
+}