let counta = 0, countb = 0

function foo(arg2) {
    try {
        Number.prototype.toString.call(arg2)
        counta++
    } catch (e) {
        countb++
    }
}

for (let i = 0; i < 1000; i++) {
    foo({});
    foo(i);
}
print(counta, countb)


With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0

The correct value for counta should be 500, but actually it is not. In DFGBytecodeParser, NumberProtoFuncToString is converted to ToString. Thus, it does not throw an exception for Number.prototype.toString when the parameter is Object.