diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 5d756e3..17b7da0 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,25 @@
+2013-03-20  Filip Pizlo  <fpizlo@apple.com>
+
+        "" + x where x is not a string should be optimized by the DFG to some manner of ToString conversion
+        https://bugs.webkit.org/show_bug.cgi?id=112845
+
+        Reviewed by Mark Hahnenberg.
+        
+        I like to do "" + x. So I decided to make DFG recognize it, and related idioms.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupToPrimitive):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::fixupToString):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::resultOfToPrimitive):
+        (DFG):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPredictionPropagationPhase.h:
+        (DFG):
+
 2013-03-20  Zoltan Herczeg  <zherczeg@webkit.org>
 
         ARMv7 replaceWithJump ASSERT failure after r135330.
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 30318f3..4debbac 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -31,6 +31,7 @@
 #include "DFGGraph.h"
 #include "DFGInsertionSet.h"
 #include "DFGPhase.h"
+#include "DFGPredictionPropagationPhase.h"
 #include "DFGVariableAccessDataDump.h"
 #include "Operations.h"
 
@@ -555,61 +556,12 @@
         }
             
         case ToPrimitive: {
-            if (node->child1()->shouldSpeculateInteger()) {
-                setUseKindAndUnboxIfProfitable<Int32Use>(node->child1());
-                node->convertToIdentity();
-                break;
-            }
-            
-            if (node->child1()->shouldSpeculateString()) {
-                setUseKindAndUnboxIfProfitable<StringUse>(node->child1());
-                node->convertToIdentity();
-                break;
-            }
-            
-            if (node->child1()->shouldSpeculateStringObject()
-                && canOptimizeStringObjectAccess(node->codeOrigin)) {
-                setUseKindAndUnboxIfProfitable<StringObjectUse>(node->child1());
-                node->convertToToString();
-                break;
-            }
-            
-            if (node->child1()->shouldSpeculateStringOrStringObject()
-                && canOptimizeStringObjectAccess(node->codeOrigin)) {
-                setUseKindAndUnboxIfProfitable<StringOrStringObjectUse>(node->child1());
-                node->convertToToString();
-                break;
-            }
-            
-            // FIXME: Add string speculation here.
-            // https://bugs.webkit.org/show_bug.cgi?id=110175
+            fixupToPrimitive(node);
             break;
         }
             
         case ToString: {
-            if (node->child1()->shouldSpeculateString()) {
-                setUseKindAndUnboxIfProfitable<StringUse>(node->child1());
-                node->convertToIdentity();
-                break;
-            }
-            
-            if (node->child1()->shouldSpeculateStringObject()
-                && canOptimizeStringObjectAccess(node->codeOrigin)) {
-                setUseKindAndUnboxIfProfitable<StringObjectUse>(node->child1());
-                break;
-            }
-            
-            if (node->child1()->shouldSpeculateStringOrStringObject()
-                && canOptimizeStringObjectAccess(node->codeOrigin)) {
-                setUseKindAndUnboxIfProfitable<StringOrStringObjectUse>(node->child1());
-                break;
-            }
-            
-            if (node->child1()->shouldSpeculateCell()) {
-                setUseKindAndUnboxIfProfitable<CellUse>(node->child1());
-                break;
-            }
-            
+            fixupToString(node);
             break;
         }
             
@@ -981,6 +933,61 @@
         }
     }
     
+    void fixupToPrimitive(Node* node)
+    {
+        if (node->child1()->shouldSpeculateInteger()) {
+            setUseKindAndUnboxIfProfitable<Int32Use>(node->child1());
+            node->convertToIdentity();
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateString()) {
+            setUseKindAndUnboxIfProfitable<StringUse>(node->child1());
+            node->convertToIdentity();
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateStringObject()
+            && canOptimizeStringObjectAccess(node->codeOrigin)) {
+            setUseKindAndUnboxIfProfitable<StringObjectUse>(node->child1());
+            node->convertToToString();
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateStringOrStringObject()
+            && canOptimizeStringObjectAccess(node->codeOrigin)) {
+            setUseKindAndUnboxIfProfitable<StringOrStringObjectUse>(node->child1());
+            node->convertToToString();
+            return;
+        }
+    }
+    
+    void fixupToString(Node* node)
+    {
+        if (node->child1()->shouldSpeculateString()) {
+            setUseKindAndUnboxIfProfitable<StringUse>(node->child1());
+            node->convertToIdentity();
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateStringObject()
+            && canOptimizeStringObjectAccess(node->codeOrigin)) {
+            setUseKindAndUnboxIfProfitable<StringObjectUse>(node->child1());
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateStringOrStringObject()
+            && canOptimizeStringObjectAccess(node->codeOrigin)) {
+            setUseKindAndUnboxIfProfitable<StringOrStringObjectUse>(node->child1());
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateCell()) {
+            setUseKindAndUnboxIfProfitable<CellUse>(node->child1());
+            return;
+        }
+    }
+    
     template<UseKind leftUseKind>
     bool attemptToMakeFastStringAdd(Node* node, Edge& left, Edge& right)
     {
@@ -989,32 +996,37 @@
         if (isStringObjectUse<leftUseKind>() && !canOptimizeStringObjectAccess(node->codeOrigin))
             return false;
         
-        if (right->shouldSpeculateString()) {
-            convertStringAddUse<leftUseKind>(node, left);
+        convertStringAddUse<leftUseKind>(node, left);
+        
+        if (right->shouldSpeculateString())
             convertStringAddUse<StringUse>(node, right);
-            convertToMakeRope(node);
-            return true;
-        }
-        
-        if (right->shouldSpeculateStringObject()
-            && canOptimizeStringObjectAccess(node->codeOrigin)) {
-            convertStringAddUse<leftUseKind>(node, left);
+        else if (right->shouldSpeculateStringObject() && canOptimizeStringObjectAccess(node->codeOrigin))
             convertStringAddUse<StringObjectUse>(node, right);
-            convertToMakeRope(node);
-            return true;
-        }
-        
-        if (right->shouldSpeculateStringOrStringObject()
-            && canOptimizeStringObjectAccess(node->codeOrigin)) {
-            convertStringAddUse<leftUseKind>(node, left);
+        else if (right->shouldSpeculateStringOrStringObject() && canOptimizeStringObjectAccess(node->codeOrigin))
             convertStringAddUse<StringOrStringObjectUse>(node, right);
-            convertToMakeRope(node);
-            return true;
+        else {
+            // At this point we know that the other operand is something weird. The semantically correct
+            // way of dealing with this is:
+            //
+            // MakeRope(@left, ToString(ToPrimitive(@right)))
+            //
+            // So that's what we emit. NB, we need to do all relevant type checks on @left before we do
+            // anything to @right, since ToPrimitive may be effectful.
+            
+            Node* toPrimitive = m_insertionSet.insertNode(
+                m_indexInBlock, resultOfToPrimitive(right->prediction()), ToPrimitive, node->codeOrigin,
+                Edge(right.node()));
+            Node* toString = m_insertionSet.insertNode(
+                m_indexInBlock, SpecString, ToString, node->codeOrigin, Edge(toPrimitive));
+            
+            fixupToPrimitive(toPrimitive);
+            fixupToString(toString);
+            
+            right.setNode(toString);
         }
         
-        // FIXME: We ought to be able to convert the right case to do
-        // ToPrimitiveToString.
-        return false; // Let the slow path worry about it.
+        convertToMakeRope(node);
+        return true;
     }
     
     bool isStringPrototypeMethodSane(Structure* stringPrototypeStructure, const Identifier& ident)
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
index c32f846..a72e7ab 100644
--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
@@ -34,6 +34,17 @@
 
 namespace JSC { namespace DFG {
 
+SpeculatedType resultOfToPrimitive(SpeculatedType type)
+{
+    if (type & SpecObject) {
+        // Objects get turned into strings. So if the input has hints of objectness,
+        // the output will have hinsts of stringiness.
+        return mergeSpeculations(type & ~SpecObject, SpecString);
+    }
+    
+    return type;
+}
+
 class PredictionPropagationPhase : public Phase {
 public:
     PredictionPropagationPhase(Graph& graph)
@@ -421,22 +432,8 @@
             
         case ToPrimitive: {
             SpeculatedType child = node->child1()->prediction();
-            if (child) {
-                if (isObjectSpeculation(child)) {
-                    // I'd love to fold this case into the case below, but I can't, because
-                    // removing SpecObject from something that only has an object
-                    // prediction and nothing else means we have an ill-formed SpeculatedType
-                    // (strong predict-none). This should be killed once we remove all traces
-                    // of static (aka weak) predictions.
-                    changed |= mergePrediction(SpecString);
-                } else if (child & SpecObject) {
-                    // Objects get turned into strings. So if the input has hints of objectness,
-                    // the output will have hinsts of stringiness.
-                    changed |= mergePrediction(
-                        mergeSpeculations(child & ~SpecObject, SpecString));
-                } else
-                    changed |= mergePrediction(child);
-            }
+            if (child)
+                changed |= mergePrediction(resultOfToPrimitive(child));
             break;
         }
             
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.h b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.h
index ae025cd..29fe845 100644
--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.h
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.h
@@ -30,6 +30,8 @@
 
 #if ENABLE(DFG_JIT)
 
+#include "SpeculatedType.h"
+
 namespace JSC { namespace DFG {
 
 class Graph;
@@ -45,6 +47,9 @@
 
 bool performPredictionPropagation(Graph&);
 
+// Helper used for FixupPhase for computing the predicted type of a ToPrimitive.
+SpeculatedType resultOfToPrimitive(SpeculatedType type);
+
 } } // namespace JSC::DFG::Phase
 
 #endif // ENABLE(DFG_JIT)