test262/implementation-contributed/javascriptcore/stress/cant-eliminate-string-object-structure-check-when-string-object-is-proven.js

//@ runDefault("--forceEagerCompilation=1", "--useConcurrentJIT=0")

function foo(x) {
    x.toString();
}

var a = new String();
a.valueOf = 0
for (var i = 0; i < 5; i++) {
    foo(a)
}