chromium/src/third_party/blink/web_tests/fast/dom/Window/Location/location-override-toString-on-proto.html - manifest_repos/chromium_src - Git at Google

 <html>
 <head>
     <script src="../../../../resources/js-test.js"></script>
     <script src="resources/location-tests-functions.js"></script>
 </head>
 <body>
 <script>
     window.location.__proto__.toString = function() { return "haxored"; }

     var result = normalizeURL(String(window.location));
     var correctValue = normalizeURL(document.URL);
     shouldBe("result", "correctValue");
 </script>
 </body>
 </html>
	<html>
	<head>
	<script src="../../../../resources/js-test.js"></script>
	<script src="resources/location-tests-functions.js"></script>
	</head>
	<body>
	<script>
	window.location.__proto__.toString = function() { return "haxored"; }

	var result = normalizeURL(String(window.location));
	var correctValue = normalizeURL(document.URL);
	shouldBe("result", "correctValue");
	</script>
	</body>
	</html>