LayoutTests/js/script-tests/dfg-to-string-toString-becomes-bad-with-check-structure.js

description(
"Tests that the DFG checks that the toString method didn't become bad even if the StringObject already had a CheckStructure."
);

function foo() {
    return String(this);
}

for (var i = 0; i < 100; ++i) {
    if (i == 99)
        String.prototype.toString = function() { return 42; }
    shouldBe("foo.call(new String(\"foo\"))", i >= 99 ? "\"42\"" : "\"foo\"");
}