Bug 1246552 - IonMonkey: Don't eliminate toString on objects and symbols, r=jandem

js/src/jit-test/tests/ion/bug1246552.js

@@ -0,0 +1,11 @@
+
+var t = 0;
+var y = [];
+y.toString = (function() { t += 1 });
+function test() {
+    for (var i = 0; i < 14; i++) {
+        String.prototype.sup.call(y);
+    }
+}
+test();
+assertEq(t, 14);

js/src/jit/MIR.h

@@ -5518,6 +5518,10 @@ class MToString :
     {
         setResultType(MIRType_String);
         setMovable();
+
+        // Objects might override toString and Symbols throw.
+        if (def->mightBeType(MIRType_Object) || def->mightBeType(MIRType_Symbol))
+            setGuard();
     }
 
   public: