JSObject::toString(ExecState *) implements the (internal) ToString type conversion operator defined in ECMA-262 9.8. That definition applies to all objects, so classes deriving from JSObject should not -- and have no reason to -- override toString. The correct way to customize the string representation of host objects is to implement in their prototype either a toString() method or the [[DefaultValue]]() internal method. (The native [[DefaultValue]] uses toString, but Firefox compatibility will probably require overriding [[DefaultValue]] as well).
Created attachment 10454 [details] Test matrix for an HTML element This table shows the value of several expressions that (should) invoke ToString, ToPrimitive, [[DefaultValue]], and possibly toString and valueOf. The table shows that, assuming it follows the spec, Firefox overrides [[DefaultValue]] so that when it's called without a hint, it does not invoke valueOf. Classes that currently override JSObject::toString() are DOMObject, DOMNode, JSHTMLElement, Window, FrameArray, Location, Selection and History.
Created attachment 13473 [details] Unfinished patch
Created attachment 14815 [details] updated patch
Comment on attachment 14815 [details] updated patch Geoff gave me the thumbs up on this baby!
Landed in r21927.