chromium/src/third_party/blink/web_tests/fast/dom/Window/Location/location-override-toString-on-proto-using-with.html - manifest_repos/chromium_src - Git at Google

 <html>
 <head>
     <script src="../../../../resources/js-test.js"></script>
     <script src="resources/location-tests-functions.js"></script>
 </head>
 <body>
 <script>
     with (window.location.__proto__) {
         var toString = function() { return "haxored"; }
     }

     var result = normalizeURL(String(window.location));
     var correctValue = normalizeURL(document.URL);
     shouldBe("result", "correctValue");
 </script>
 </body>
 </html>
	<html>
	<head>
	<script src="../../../../resources/js-test.js"></script>
	<script src="resources/location-tests-functions.js"></script>
	</head>
	<body>
	<script>
	with (window.location.__proto__) {
	var toString = function() { return "haxored"; }
	}

	var result = normalizeURL(String(window.location));
	var correctValue = normalizeURL(document.URL);
	shouldBe("result", "correctValue");
	</script>
	</body>
	</html>