Does valueOf always override toString in javascript?

Question

Is there any expression where by an object's toString method is implicitly called overriding its valueOf method?

In the examples below, valueOf is always called implicitly (overriding toString).

"4" + {
    toString: function () {
        return "4";
    },
    valueOf: function () {
        return 6;
    }
};    // => "46", was expecting "44"

4 + {
    toString: function () {
        return "6";
    },
    valueOf: function () {
        return 4;
    }
};    // => 8

4 + {
    toString: function () {
        return 6;
    },
    valueOf: function() {
        return "4";
    }
};    // => "44"

i.e.:

Can we write an expression where by toString is implicitly called over valueOf (i.e without explicitly calling toString)?

Answer 1

Is there any expression where by an object's toString method is implicitly called overriding its valueOf method?

Yes, that does happen whenever the abstract ToString operation is applied on an object, using the DefaultValue procedure with .toString() before .valueOf().

However, in your examples you have only used the addition operator which is like an exception from the standard behaviour. Since it does not only concatenate strings, but also sums numbers, it always uses valueOf on both operands before checking whether they're strings. See the note 1:

No hint is provided in the calls to ToPrimitive in steps 5 and 6. All native ECMAScript objects except Date objects handle the absence of a hint as if the hint Number were given; Date objects handle the absence of a hint as if the hint String were given. Host objects may handle the absence of a hint in some other manner.

So which operations do implicitly use the ToString instead of a hint-less ToPrimitive? Here are a few examples:

• Everything about property names: The in operator, bracket notation, Object.getOwnPropertyDescriptor, Object.defineProperty, hasOwnProperty, …
• Functions expecting strings as arguments: parseInt, parseFloat, encodeURI[Component], decodeURI[Component], [un]escape, Array::join, String::[last]indexOf, RegExp::exec
• The Function constructor
• The Array::sort algorithm's default compare function
• The String constructor and String methods when casting the this object to a string
• The RegExp constructor
• The Error constructors
• Lots of other functions not specified by EcmaScript but in the DOM or somewhere else, like alert, XMlHTTPRequest::open, querySelector, …