Remove unneeded ToString calls. We call ToString if necessary...

src/string.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 415 matching lines @@
 // Helper function to apply a string replacement function once.
 function ApplyReplacementFunction(replace, lastMatchInfo, subject) {
   // Compute the parameter list consisting of the match, captures, index,
   // and subject for the replace function invocation.
   var index = lastMatchInfo[CAPTURE0];
   // The number of captures plus one for the match.
   var m = NUMBER_OF_CAPTURES(lastMatchInfo) >> 1;
   if (m == 1) {
     var s = CaptureString(subject, lastMatchInfo, 0);
     // Don't call directly to avoid exposing the built-in global object.
-    return ToString(replace.call(null, s, index, subject));
+    return replace.call(null, s, index, subject);
   }
   var parameters = $Array(m + 2);
   for (var j = 0; j < m; j++) {
     parameters[j] = CaptureString(subject, lastMatchInfo, j);
   }
   parameters[j] = index;
   parameters[j + 1] = subject;
-  return ToString(replace.apply(null, parameters));
+  return replace.apply(null, parameters);
 }
 
 
 // ECMA-262 section 15.5.4.12
 function StringSearch(re) {
   var regexp = new ORIGINAL_REGEXP(re);
   var s = ToString(this);
   var last_idx = regexp.lastIndex; // keep old lastIndex
   regexp.lastIndex = 0;            // ignore re.global property
   var result = regexp.exec(s);
@@ skipping 412 matching lines @@
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup,
     "toJSON", StringToJSON
   ));
 }
 
 
 SetupString();