1 2 3 4 5 6
a = []; minorgc(); Object.defineProperty(a, 12, {}).push(1); toString = (function() { return a.reverse(); }); oomTest(Date.prototype.toJSON); oomTest(Date.prototype.toJSON);