Treat failed access checks for @@toStringTag as undefined

test/cctest/test-api.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 22000 matching lines @@
   // If access check fails, the value of @@isConcatSpreadable is ignored
   allowed_access = false;
   CompileRun("var result = [].concat(object)");
   ExpectTrue("Array.isArray(result)");
   ExpectTrue("result[0] === object");
   ExpectTrue("result.length === 1");
   ExpectTrue("object[Symbol.isConcatSpreadable] === undefined");
 }
 
 
+TEST(AccessCheckedToStringTag) {
+  i::FLAG_harmony_tostring = true;
+  v8::Isolate* isolate = CcTest::isolate();
+  HandleScope scope(isolate);
+  LocalContext env;
+
+  // Object with access check
+  Local<ObjectTemplate> object_template = v8::ObjectTemplate::New(isolate);
+  object_template->SetAccessCheckCallback(AccessBlocker);
+  Local<Object> object = object_template->NewInstance();
+
+  allowed_access = true;
+  env->Global()->Set(v8_str("object"), object);
+  object->Set(v8::Symbol::GetToStringTag(isolate), v8_str("hello"));
+
+  // Access check is allowed, and the toStringTag is read
+  CompileRun("var result = Object.prototype.toString.call(object)");
+  ExpectString("result", "[object hello]");
+  ExpectString("object[Symbol.toStringTag]", "hello");
+
+  // If access check fails, the value of @@toStringTag is ignored
+  allowed_access = false;
+  CompileRun("var result = Object.prototype.toString.call(object)");
+  ExpectString("result", "[object Object]");
+  ExpectTrue("object[Symbol.toStringTag] === undefined");
+}
+
+
 TEST(ObjectTemplateIntrinsics) {
   v8::Isolate* isolate = CcTest::isolate();
   v8::HandleScope scope(isolate);
   LocalContext env;
 
   Local<ObjectTemplate> object_template = v8::ObjectTemplate::New(isolate);
   object_template->SetIntrinsicDataProperty(v8_str("values"),
                                             v8::kArrayProto_values);
   Local<Object> object = object_template->NewInstance();
 
@@ skipping 11 matching lines @@
     env2->Global()->Set(v8_str("obj2"), object2);
     ExpectString("typeof obj2.values", "function");
     CHECK_NE(*object->Get(v8_str("values")), *object2->Get(v8_str("values")));
 
     auto values2 = Local<Function>::Cast(object2->Get(v8_str("values")));
     auto fn2 = i::Handle<i::JSFunction>::cast(v8::Utils::OpenHandle(*values2));
     auto ctx2 = v8::Utils::OpenHandle(*env2.local());
     CHECK_EQ(fn2->GetCreationContext(), *ctx2);
   }
 }