toLocaleString in JIT

The following PoC outputs differently before/after JIT compilation.


function opt(opt_param){
function v0(v1,v2) {
    const v7 = [];
    const v6 = JSON.stringify(v7);
    const v8 = v7.__proto__;
    v8[1024] = v6;
    const v9 = v8.sort(); }
const v11 = new Promise(v0,Promise);
const v14 = [,686329.1200909126,,];
const v15 = v14.toLocaleString();
return v15; }
let r1 = opt();
print(r1); //  [],686,329.12,
for(let i =0; i<100; i++){opt();}
let r2 = opt();
print(r2); //  [],686,329.12,[]

[Radar WebKit Bug Importer]

<rdar://problem/125657806>