JSTests/stress/fold-to-primitive-in-cfa.js

function foo(x) {
    if ($vm.dfgTrue())
        x = "hello";
    return x + " world";
}

noInline(foo);

for (var i = 0; i < 100000; ++i) {
    var result = foo({toString:function() { return "foo" }});
    if (result != "foo world" && result != "hello world")
        throw "Error: bad result: " + result;
}