From c3715ce3db4cc37ea46af8dbc891ecee1ca1b2ff Mon Sep 17 00:00:00 2001
From: Tor Andersson <tor.andersson@artifex.com>
Date: Tue, 8 Jun 2021 13:28:41 +0200
Subject: [PATCH] Fix error in Array.prototype.toString().

---
 jsarray.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/jsarray.c b/jsarray.c
index d47172d..1920e5e 100644
--- a/jsarray.c
+++ b/jsarray.c
@@ -427,14 +427,16 @@ static void Ap_toString(js_State *J)
 		js_typeerror(J, "'this' is not an object");
 	js_getproperty(J, 0, "join");
 	if (!js_iscallable(J, -1)) {
-		// TODO: call Object.prototype.toString implementation; not via Object.toString JS objects
+		js_pop(J, 1);
+		// TODO: call Object.prototype.toString implementation directly
 		js_getglobal(J, "Object");
+		js_getproperty(J, -1, "prototype");
+		js_rot2pop1(J);
 		js_getproperty(J, -1, "toString");
 		js_rot2pop1(J);
 	}
 	js_copy(J, 0);
 	js_call(J, 0);
-	js_pop(J, 1);
 }
 
 static void Ap_indexOf(js_State *J)