Fix Object.prototype.toString() when @@toStringTag is not a string.

Fix Object.prototype.toString() when @@toStringTag is not a string.

ES2017 draft 19.1.3.6: If @@toStringTag is not a string, Object.prototype.toString()
returns [object Object], except in the following cases:
 - Array
 - String
 - Arguments
 - Function
 - Error
 - Boolean
 - Number
 - Date
 - RegExp.

For anything else, e.g., Maps, Sets, TypedArrays, or the global object, toString() returns
[object Object] if @@toStringTag is absent or not a string. In order to be able to
easily identify the global object in d8, we set @@toStringTag to "global"
for d8.

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=

Committed: https://crrev.com/bdc78957e55ef2062bfdf59c29cbe45f50df2d3b
Cr-Commit-Position: refs/heads/master@{#37218}

[Franzi, 2016-06-20 05:41:07]

Description was changed from

==========
WIP.

Support for Map/Set Iterator.
Add support for Generator, ArrayBuffer, DataView, Maps, and Sets.
Add tests.

BUG=
==========

to

==========
According to 19.1.3.6, toString() returns [object Object] if @@toStringTag
is not a string for many instance types, including Map, Set, Promise,
Generator, and array-like objects.


CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

[Franzi, 2016-06-20 05:43:59]

Description was changed from

==========
According to 19.1.3.6, toString() returns [object Object] if @@toStringTag
is not a string for many instance types, including Map, Set, Promise,
Generator, and array-like objects.


CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

to

==========
According to 19.1.3.6, Object.prototype.toString() returns [object Object] if
@@toStringTag
is not a string for many instance types, including Map, Set, Promise,
Generator, and array-like objects.


CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

[Franzi, 2016-06-20 09:57:23]

franzih@chromium.org changed reviewers:
+ adamk@chromium.org, littledan@chromium.org, verwaest@chromium.org

[Franzi, 2016-06-20 09:57:23]

Hi, 

I was refactoring Object.prototype.toString() to use the instance type instead
of class_name(). I think we are not handling the cases when @@toStringTag is not
a string correctly. 

According to ES2017 19.1.3.6, if @@toStringTag is not a string,
Object.prototype.toString() should always return [object Object] except if we
deal with Array, String, Arguments, Function, Error, Boolean, Number, Date, or
RegExp. So specifically, Map, Set, WeakMap, WeakSet, Map Iterator, Set Iterator,
Generator, ArrayBuffer, DataView, and TypedArrays should return [object Object]
and not e.g., [object Map] if @@toStringTag is not a string. 

Similarly, Object.prototype.toString() of a GeneratorFunction returns [object
Function] if @@toStringTag is not a string anymore. This was already correct
because we never use class_name() for functions.

Here's a fix and tests for those cases. I'll put the refactoring in a separate
cl to make reviewing easier. 

Could you please have a look. Thanks, 

Franzi

[Toon Verwaest, 2016-06-20 14:39:45]

Good catch.
Seems like builtinStringTag should just support the types listed between step 4
and 14 though; rather than getting the value and then overwriting it later?
Can't we just switch over the instance types of those few cases?

[caitp (gmail), 2016-06-20 15:04:11]

On 2016/06/20 14:39:45, Toon Verwaest wrote:
> Good catch.
> Seems like builtinStringTag should just support the types listed between step
4
> and 14 though; rather than getting the value and then overwriting it later?
> Can't we just switch over the instance types of those few cases?

I think we originally just used class_name for the builtin tag name to mitigate
performance hit of @@toStringTag

[adamk, 2016-06-20 16:39:12]

Description was changed from

==========
According to 19.1.3.6, Object.prototype.toString() returns [object Object] if
@@toStringTag
is not a string for many instance types, including Map, Set, Promise,
Generator, and array-like objects.


CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

to

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.

According to 19.1.3.6, Object.prototype.toString() returns [object Object] if
@@toStringTag
is not a string for many instance types, including Map, Set, Promise,
Generator, and array-like objects.


CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

[Franzi, 2016-06-21 09:02:02]

On 2016/06/20 14:39:45, Toon Verwaest wrote:
> Good catch.
> Seems like builtinStringTag should just support the types listed between step
4
> and 14 though; rather than getting the value and then overwriting it later?
> Can't we just switch over the instance types of those few cases?

You're right. That is much nicer. Please take another look.

Thanks, 

Franzi

[Toon Verwaest, 2016-06-21 13:10:53]

What I meant was doing the opposite: only return non-Object if it's one of the
instance types listed in the spec. Otherwise you'll be chasing after every new
type introduced. Whitelisting is better than blacklisting.

[Franzi, 2016-06-23 09:05:25]

Description was changed from

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.

According to 19.1.3.6, Object.prototype.toString() returns [object Object] if
@@toStringTag
is not a string for many instance types, including Map, Set, Promise,
Generator, and array-like objects.


CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

to

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.


According to 19.1.3.6: If @@toStringTag is not a string,
Object.prototype.toString() returns [object Object], except in the following
cases:
 - Array
 - String
 - Arguments
 - Function
 - Error
 - Boolean
 - Number
 - Date
 - RegExp.


CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

[Franzi, 2016-06-23 09:12:18]

Description was changed from

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.


According to 19.1.3.6: If @@toStringTag is not a string,
Object.prototype.toString() returns [object Object], except in the following
cases:
 - Array
 - String
 - Arguments
 - Function
 - Error
 - Boolean
 - Number
 - Date
 - RegExp.


CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

to

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.


According to 19.1.3.6: If @@toStringTag is not a string,
Object.prototype.toString() 
returns [object Object], except in the following cases:
 - Array
 - String
 - Arguments
 - Function
 - Error
 - Boolean
 - Number
 - Date
 - RegExp.

For anything else, e.g., Maps, Sets, TypedArrays, or the global object,
toString() returns 
[object Object] if the @@toStringTag is absent or not a string. In order to be
able to
easily identify the global object in d8, we specifically set @@toStringTag to
"global"
for d8. 

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

[Franzi, 2016-06-23 11:29:02]

Description was changed from

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.


According to 19.1.3.6: If @@toStringTag is not a string,
Object.prototype.toString() 
returns [object Object], except in the following cases:
 - Array
 - String
 - Arguments
 - Function
 - Error
 - Boolean
 - Number
 - Date
 - RegExp.

For anything else, e.g., Maps, Sets, TypedArrays, or the global object,
toString() returns 
[object Object] if the @@toStringTag is absent or not a string. In order to be
able to
easily identify the global object in d8, we specifically set @@toStringTag to
"global"
for d8. 

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

to

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.

ES2017 draft 19.1.3.6: If @@toStringTag is not a string,
Object.prototype.toString() 
returns [object Object], except in the following cases:
 - Array
 - String
 - Arguments
 - Function
 - Error
 - Boolean
 - Number
 - Date
 - RegExp.

For anything else, e.g., Maps, Sets, TypedArrays, or the global object,
toString() returns 
[object Object] if @@toStringTag is absent or not a string. In order to be able
to
easily identify the global object in d8, we set @@toStringTag to "global"
for d8. 

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

[Franzi, 2016-06-23 11:47:14]

Hi, 

I changed the blacklist to a whitelist and fixed the global object case. Please
take a look. 

Thanks, 

Franzi

[Toon Verwaest, 2016-06-23 12:00:40]

lgtm

[Franzi, 2016-06-23 12:14:20]

The CQ bit was checked by franzih@chromium.org

[commit-bot: I haz the power, 2016-06-23 12:14:32]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2071343002/200001

[commit-bot: I haz the power, 2016-06-23 13:37:46]

Description was changed from

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.

ES2017 draft 19.1.3.6: If @@toStringTag is not a string,
Object.prototype.toString() 
returns [object Object], except in the following cases:
 - Array
 - String
 - Arguments
 - Function
 - Error
 - Boolean
 - Number
 - Date
 - RegExp.

For anything else, e.g., Maps, Sets, TypedArrays, or the global object,
toString() returns 
[object Object] if @@toStringTag is absent or not a string. In order to be able
to
easily identify the global object in d8, we set @@toStringTag to "global"
for d8. 

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

to

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.

ES2017 draft 19.1.3.6: If @@toStringTag is not a string,
Object.prototype.toString() 
returns [object Object], except in the following cases:
 - Array
 - String
 - Arguments
 - Function
 - Error
 - Boolean
 - Number
 - Date
 - RegExp.

For anything else, e.g., Maps, Sets, TypedArrays, or the global object,
toString() returns 
[object Object] if @@toStringTag is absent or not a string. In order to be able
to
easily identify the global object in d8, we set @@toStringTag to "global"
for d8. 

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

[commit-bot: I haz the power, 2016-06-23 13:37:47]

Committed patchset #11 (id:200001)

[commit-bot: I haz the power, 2016-06-23 13:40:12]

Description was changed from

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.

ES2017 draft 19.1.3.6: If @@toStringTag is not a string,
Object.prototype.toString() 
returns [object Object], except in the following cases:
 - Array
 - String
 - Arguments
 - Function
 - Error
 - Boolean
 - Number
 - Date
 - RegExp.

For anything else, e.g., Maps, Sets, TypedArrays, or the global object,
toString() returns 
[object Object] if @@toStringTag is absent or not a string. In order to be able
to
easily identify the global object in d8, we set @@toStringTag to "global"
for d8. 

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=
==========

to

==========
Fix Object.prototype.toString() when @@toStringTag is not a string.

ES2017 draft 19.1.3.6: If @@toStringTag is not a string,
Object.prototype.toString()
returns [object Object], except in the following cases:
 - Array
 - String
 - Arguments
 - Function
 - Error
 - Boolean
 - Number
 - Date
 - RegExp.

For anything else, e.g., Maps, Sets, TypedArrays, or the global object,
toString() returns
[object Object] if @@toStringTag is absent or not a string. In order to be able
to
easily identify the global object in d8, we set @@toStringTag to "global"
for d8.

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=

Committed: https://crrev.com/bdc78957e55ef2062bfdf59c29cbe45f50df2d3b
Cr-Commit-Position: refs/heads/master@{#37218}
==========

[commit-bot: I haz the power, 2016-06-23 13:40:14]

Patchset 11 (id:??) landed as
https://crrev.com/bdc78957e55ef2062bfdf59c29cbe45f50df2d3b
Cr-Commit-Position: refs/heads/master@{#37218}