But hackedPush is added to the instance, not Array.prototype.

On Nov 4, 2011, at 18:59 , Allen Wirfs-Brock wrote:

> 
> On Nov 4, 2011, at 10:33 AM, Axel Rauschmayer wrote:
> 
>> How about:
>> 
>>   function Bob(t) {
>>      var stolenArray;
>>      var hackedPush = function() {
>>          stolenArray = this;
>>      };
>>      t.store("push", hackedPush);
> 
> 
> If Array.prototype has been frozen (as the problem statement implied) then 
> the above line should throw.
> 
> 
> Allen

-- 
Dr. Axel Rauschmayer
[email protected]

home: rauschma.de
twitter: twitter.com/rauschma
blog: 2ality.com



_______________________________________________
es-discuss mailing list
[email protected]
https://mail.mozilla.org/listinfo/es-discuss

Reply via email to