Array toString recurses infinitely in case of cycle

[bvibber]

This code:

var a = [], b = [];
a.push(b); b.push(a);
alert(a);

hangs or crashes the interpreter with infinite recursion in the Array toString implementation.

In browsers, cycles in array toString() seem to be broken with empty strings:

var a = [ 'AA', 0, 'AZ' ];
var b = ['BA', 0, 'BZ'];
a[1] = b;
b[1] = a;
alert(a);

should give

AA,BA,,BZ,AZ

[bvibber]

Note that the spec for Array.prototype.join does not reflect this behavior of browsers -- see tc39/ecma262#289 -- but not crashing seems like a good thing. :D