array-join-element-tostring-prototype-side-effects.js 358 Bytes
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

(function ArrayPrototypeChanged() {
  const el = {
    toString() {
      Array.prototype[1] = '2';
      return '1';
    }
  };
  const a = [el, ,3];
  assertSame("123", a.join(''));
})();