ToPrimitive(obj),先调用 obj.valueOf(),判断是否是基础数据类型,若不是,则调用 obj.toString()
[] == ![] => [] == !Boolean([]) => [] == !true => [] == false => "" == false => true console.log(([][[]]+[])[+!![]]+([]+{})[!+[]+!![]]) ([][[]]+[]) ([][[]]+[]) => ([][""]+[]) => (undefined + []) => ("undefined") [+!![]] [+!![]] => [+!!Boolean([])] => [+!!true] => [+true] => [+1] => [1] ([][[]]+[])[+!![]] => ("undefined")[1] => "n" ([]+{}) ([]+{}) => ("[object object]") [!+[]+!![]] [!+[]+!![]] => [!+[]+true] => [!+"" + true] => [!+0+true] => [!0+true] => [1+true] => [2] 那么 ([]+{})[!+[]+!![]] => ("[object object]")[2] => "b"综上
console.log(([][[]]+[])[+!![]]+([]+{})[!+[]+!![]]) // nb拓展
console.log((!(~+[]) + {})[--[~+""][+[]] * [~+[]] + ~~!+[]] + ({} + [])[[~!+[]] * ~+[]]) //sb console.log((![]+"")[!+[]*(!+[]+!![])]+(([]+{})[!+[]+!![]])) //lb