[crankshaft] Handle @@toStringTag accessor correctly for BuildCompareInstruction.

[crankshaft] Handle @@toStringTag accessor correctly for BuildCompareInstruction.

If @@toStringTag is an accessor property, we cannot assume that the result
of calling Object.prototype.toString() for objects with the same map.

R=adamk@chromium.org
BUG=chromium:534200
LOG=n

Committed: https://crrev.com/3d7c45371e26a3ca7b688ed73892cba44cb23c0d
Cr-Commit-Position: refs/heads/master@{#30856}

[Benedikt Meurer, 2015-09-22 03:46:20]

Hey Adam,

Thanks for the catch. Here's the fix.
Please take a look.

Thanks,
Benedikt

[adamk, 2015-09-22 03:51:08]

lgtm

Thanks for the quick fix! Symbols everywhere in ES6.

[Benedikt Meurer, 2015-09-22 03:52:47]

On 2015/09/22 03:51:08, adamk wrote:
> Thanks for the quick fix! Symbols everywhere in ES6.

I was actually asking Andreas to introduce a new well known symbol @@do on the
global object, which if present can intercept _everything_ that happens in the
native context of that global object. :-)

[Benedikt Meurer, 2015-09-22 03:52:52]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2015-09-22 03:52:56]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1360723002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1360723002/1

[commit-bot: I haz the power, 2015-09-22 04:07:58]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-09-22 04:08:18]

Patchset 1 (id:??) landed as
https://crrev.com/3d7c45371e26a3ca7b688ed73892cba44cb23c0d
Cr-Commit-Position: refs/heads/master@{#30856}