Fix NoSideEffectToString.

src/messages.js

Index: src/messages.js
diff --git a/src/messages.js b/src/messages.js
index 2dddffa57ad8cae08d6f445116558dac18e7d4a4..9d67d9ca4e216d8d72ac3e702e8e71cbfce52810 100644
--- a/src/messages.js
+++ b/src/messages.js
@@ -223,7 +223,10 @@ function NoSideEffectToString(obj) {
     return str;
   }
   if (IS_SYMBOL(obj)) return %_CallFunction(obj, SymbolToString);
-  if (IS_OBJECT(obj) && %GetDataProperty(obj, "toString") === ObjectToString) {
+  if (CanBeSafelyTreatedAsAnErrorObject(obj)) {
+    return %_CallFunction(obj, ErrorToString);
+  }
+  if (IS_OBJECT(obj)) {

[caitp (gmail), 2014/10/21 01:09:37]

So, this will cause arrays to always be reported as `#<Array>` rather than
`[object Array]` --- I'm not sure if that's the right behaviour or not ---
probably doesn't matter a whole lot, but it might be reported as a regression.
Same thing for similar cases where the `toString` function is overridden
somewhere in the prototype chain.

Maybe a better solution is to change the toStringTag CL to make this check for
both default ObjectToString functions?

     var constructor = %GetDataProperty(obj, "constructor");
     if (typeof constructor == "function") {
       var constructorName = constructor.name;
@@ -232,9 +235,6 @@ function NoSideEffectToString(obj) {
       }
     }
   }
-  if (CanBeSafelyTreatedAsAnErrorObject(obj)) {
-    return %_CallFunction(obj, ErrorToString);
-  }
   return %_CallFunction(obj, ObjectToString);
 }