This is a well-known browser security technique. In JavaScript, calling .toString() on a native browser function returns "function appendBuffer() { [native code] }". Calling it on a JavaScript function returns the actual source code. So if your appendBuffer has been monkey-patched, .toString() will betray you; it’ll return the attacker’s JavaScript source instead of the expected native code string.
When delay slots aren't enough: RPT as a stall
，这一点在一键获取谷歌浏览器下载中也有详细论述
Сайт Роскомнадзора атаковали18:00，这一点在爱思助手下载最新版本中也有详细论述
Москвичей предупредили о резком похолодании09:45。91视频对此有专业解读
Roman numerals: glyph reuse by design