[crankshaft] Handle @@toStringTag accessor correctly for BuildCompareInstruction.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast-numbering.h"
@@ skipping 11582 matching lines @@
         // even do that in Crankshaft but we don't want to waste too much
         // time on this now).
         DCHECK(Token::IsOrderedRelationalCompareOp(op));
         Handle<Map> map = combined_type->AsClass()->Map();
         PropertyAccessInfo value_of(this, LOAD, map,
                                     isolate()->factory()->valueOf_string());
         PropertyAccessInfo to_primitive(
             this, LOAD, map, isolate()->factory()->to_primitive_symbol());
         PropertyAccessInfo to_string(this, LOAD, map,
                                      isolate()->factory()->toString_string());
+        PropertyAccessInfo to_string_tag(
+            this, LOAD, map, isolate()->factory()->to_string_tag_symbol());
         if (to_primitive.CanAccessMonomorphic() && !to_primitive.IsFound() &&
+            to_string_tag.CanAccessMonomorphic() &&
+            (!to_string_tag.IsFound() || to_string_tag.IsData() ||
+             to_string_tag.IsDataConstant()) &&
             value_of.CanAccessMonomorphic() && value_of.IsDataConstant() &&
             value_of.constant().is_identical_to(isolate()->object_value_of()) &&
             to_string.CanAccessMonomorphic() && to_string.IsDataConstant() &&
             to_string.constant().is_identical_to(
                 isolate()->object_to_string())) {
           // We depend on the prototype chain to stay the same, because we
           // also need to deoptimize when someone installs @@toPrimitive
-          // somewhere in the prototype chain.
+          // or @@toStringTag somewhere in the prototype chain.
           BuildCheckPrototypeMaps(handle(JSObject::cast(map->prototype())),
                                   Handle<JSObject>::null());
           AddCheckMap(left, map);
           AddCheckMap(right, map);
           // The caller expects a branch instruction, so make it happy.
           return New<HBranch>(
               graph()->GetConstantBool(op == Token::LTE || op == Token::GTE));
         }
       }
       Bailout(kUnsupportedNonPrimitiveCompare);
@@ skipping 1981 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8