BUG=

TEST=webkit/dfg-to-string-bad-toString, webkit/dfg-to-string-bad-valueOf,
webkit/dfg-to-string-int-or-string, webkit/dfg-to-string-side-effect,
webkit/dfg-to-string-bad-toString, webkit/dfg-to-string-bad-valueOf,
webkit/dfg-to-string-toString-in-string, webkit/dfg-to-string-int,
webkit/dfg-to-string-valueOf-in-string

Review URL: https://codereview.chromium.org/18668004
Patch from Dusan Milosavljevic <Dusan.Milosavljevic@rt-rk.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00