location-override-toString-on-proto-using-defineGetter.html

<html>
<head>
    <script src="../../../../resources/js-test.js"></script>
    <script src="resources/location-tests-functions.js"></script>
</head>
<body>
<script>
    window.location.__proto__.__defineGetter__("toString", function () {
        return function() { return "haxored"; }
    });

    var result = normalizeURL(String(window.location));
    var correctValue = normalizeURL(document.URL);
    shouldBe("result", "correctValue");
</script>
</body>
</html>

chromium/third_party/blink/web_tests/fast/dom/Window/Location/location-override-toString-on-proto-using-defineGetter.html