gistfile1.txt

diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index 2f000fc..6692d8e 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -387,7 +387,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
 
     UString separator;
     if (!exec->argument(0).isUndefined())
-        separator = exec->argument(0).toString(exec)->value(exec);
+        separator = exec->argument(0).toUString(exec);
 
     unsigned k = 0;
     if (isJSArray(thisObj)) {
@@ -398,7 +398,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
                 goto skipFirstLoop;
             JSValue element = array->getIndex(k);
             if (!element.isUndefinedOrNull())
-                strBuffer.append(element.toString(exec)->value(exec));
+                strBuffer.append(element.toUString(exec));
             k++;
         }
 
@@ -409,7 +409,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
                 strBuffer.append(',');
                 JSValue element = array->getIndex(k);
                 if (!element.isUndefinedOrNull())
-                    strBuffer.append(element.toString(exec)->value(exec));
+                    strBuffer.append(element.toUString(exec));
             }
         } else {
             for (; k < length; k++) {
@@ -418,7 +418,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
                 strBuffer.append(separator);
                 JSValue element = array->getIndex(k);
                 if (!element.isUndefinedOrNull())
-                    strBuffer.append(element.toString(exec)->value(exec));
+                    strBuffer.append(element.toUString(exec));
             }
         }
     }
diff --git a/Source/JavaScriptCore/runtime/JSValue.cpp b/Source/JavaScriptCore/runtime/JSValue.cpp
index 36697c6..695db09 100644
--- a/Source/JavaScriptCore/runtime/JSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSValue.cpp
@@ -282,4 +282,29 @@ JSString* JSValue::toStringSlowCase(ExecState* exec) const
     return value.toString(exec);
 }
 
+UString JSValue::toUString(ExecState* exec) const
+{
+    if (isString())
+        return static_cast<JSString*>(asCell())->value(exec);
+    if (isInt32())
+        return exec->globalData().numericStrings.add(asInt32());
+    if (isDouble())
+        return exec->globalData().numericStrings.add(asDouble());
+    if (isTrue())
+        return exec->propertyNames().trueKeyword.ustring();
+    if (isFalse())
+        return exec->propertyNames().falseKeyword.ustring();
+    if (isNull())
+        return exec->propertyNames().nullKeyword.ustring();
+    if (isUndefined())
+        return exec->propertyNames().undefined.ustring();
+
+    ASSERT(isCell());
+    JSValue value = asCell()->toPrimitive(exec, PreferString);
+    if (exec->hadException())
+        return UString();
+    ASSERT(!value.isObject());
+    return value.toUString(exec);
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSValue.h b/Source/JavaScriptCore/runtime/JSValue.h
index a6f3593..21d8639 100644
--- a/Source/JavaScriptCore/runtime/JSValue.h
+++ b/Source/JavaScriptCore/runtime/JSValue.h
@@ -202,6 +202,7 @@ namespace JSC {
         // been set in the ExecState already.
         double toNumber(ExecState*) const;
         JSString* toString(ExecState*) const;
+        UString toUString(ExecState*) const;
         JSObject* toObject(ExecState*) const;
         JSObject* toObject(ExecState*, JSGlobalObject*) const;