Since changeset 198256 wasn't merged into safari-601-branch the following change in JSStringJoiner.h is missing - append(jsString->viewWithUnderlyingString(state)); + append(value.toString(&state)->viewWithUnderlyingString(state)); But as avoiding the to call toString() was the whole purpose of changeset 198592, bug 155776 is probably still unsolved for the safari-601-branch.
I stumpled upon this because I compiled the safari-601-branch using gcc 5.3, which warned about 'jsString' being set but not used.
Thank you Tobias! We'll look into this internally at Apple, so marking INVALID in Bugzilla.
To fix the build, you can just delete the line that defines jsString.