Fix Object.prototype.toString() when @@toStringTag is not a string.

test/mjsunit/es6/object-tostring.js

Index: test/mjsunit/es6/object-tostring.js
diff --git a/test/mjsunit/es6/object-tostring.js b/test/mjsunit/es6/object-tostring.js
index 29d07f263a41b9cf6b70bae5e821d9d58bfabe94..6a2ff280665395c85c95d3776d9e366abc7fa5fd 100644
--- a/test/mjsunit/es6/object-tostring.js
+++ b/test/mjsunit/es6/object-tostring.js
@@ -15,15 +15,16 @@ var funs = {
   RegExp:   [ RegExp ],
   Error:    [ Error, TypeError, RangeError, SyntaxError, ReferenceError,
               EvalError, URIError ]
-}
-for (f in funs) {
-  for (i in funs[f]) {
+};
+for (var f in funs) {
+  for (var i in funs[f]) {
+
     assertEquals("[object " + f + "]",
-                 Object.prototype.toString.call(new funs[f][i]),
-                 funs[f][i]);
+      Object.prototype.toString.call(new funs[f][i]),
+      funs[f][i]);
     assertEquals("[object Function]",
-                 Object.prototype.toString.call(funs[f][i]),
-                 funs[f][i]);
+      Object.prototype.toString.call(funs[f][i]),
+      funs[f][i]);
   }
 }
 
@@ -130,11 +131,11 @@ function testObjectToStringPropertyDesc() {
 }
 testObjectToStringPropertyDesc();
 
-function testObjectToStringOwnNonStringValue() {
-  var obj = Object.defineProperty({}, Symbol.toStringTag, { value: 1 });
+function testObjectToStringOnNonStringValue(obj) {
+  Object.defineProperty(obj, Symbol.toStringTag, { value: 1 });
   assertEquals("[object Object]", ({}).toString.call(obj));
 }
-testObjectToStringOwnNonStringValue();
+testObjectToStringOnNonStringValue({});
 
 
 // Proxies
@@ -149,11 +150,64 @@ assertTag("Function", new Proxy(() => 42, {}));
 assertTag("Foo", new Proxy(() => 42, {get() {return "Foo"}}));
 assertTag("Function", new Proxy(() => 42, {get() {return 666}}));
 
-revocable = Proxy.revocable([], {});
+var revocable = Proxy.revocable([], {});
 revocable.revoke();
 assertThrows(() => Object.prototype.toString.call(revocable.proxy), TypeError);
 
-handler = {};
+var handler = {};
 revocable = Proxy.revocable([], handler);
 handler.get = () => revocable.revoke();
 assertThrows(() => Object.prototype.toString.call(revocable.proxy), TypeError);
+
+function* gen() { yield 1; }
+
+assertTag("GeneratorFunction", gen);
+Object.defineProperty(gen, Symbol.toStringTag, {writable: true});
+gen[Symbol.toStringTag] = "different string";
+assertTag("different string", gen);
+gen[Symbol.toStringTag] = 1;
+assertTag("Function", gen);
+
+function overwriteToStringTagWithNonStringValue(tag, obj) {
+  assertTag(tag, obj);
+
+  Object.defineProperty(obj, Symbol.toStringTag, {
+    configurable: true,
+    value: "different string"
+  });
+  assertTag("different string", obj);
+
+  testObjectToStringOnNonStringValue(obj);
+}
+
+overwriteToStringTagWithNonStringValue("global", global);
+overwriteToStringTagWithNonStringValue("Generator", gen());
+
+var arrayBuffer = new ArrayBuffer();
+overwriteToStringTagWithNonStringValue("ArrayBuffer", arrayBuffer);
+overwriteToStringTagWithNonStringValue("DataView", new DataView(arrayBuffer));
+
+overwriteToStringTagWithNonStringValue("Int8Array", new Int8Array());
+overwriteToStringTagWithNonStringValue("Uint8Array", new Uint8Array());
+overwriteToStringTagWithNonStringValue("Uint8ClampedArray",
+  new Uint8ClampedArray());
+overwriteToStringTagWithNonStringValue("Int16Array", new Int16Array());
+overwriteToStringTagWithNonStringValue("Uint16Array", new Uint16Array());
+overwriteToStringTagWithNonStringValue("Int32Array", new Int32Array());
+overwriteToStringTagWithNonStringValue("Uint32Array", new Uint32Array());
+overwriteToStringTagWithNonStringValue("Float32Array", new Float32Array());
+overwriteToStringTagWithNonStringValue("Float64Array", new Float64Array());
+
+var set = new Set();
+var map = new Map();
+
+overwriteToStringTagWithNonStringValue("Set", set);
+overwriteToStringTagWithNonStringValue("Map", map);
+
+overwriteToStringTagWithNonStringValue("Set Iterator", set[Symbol.iterator]());
+overwriteToStringTagWithNonStringValue("Map Iterator", map[Symbol.iterator]());
+
+overwriteToStringTagWithNonStringValue("WeakSet", new WeakSet());
+overwriteToStringTagWithNonStringValue("WeakMap", new WeakMap());
+
+overwriteToStringTagWithNonStringValue("Promise", new Promise(function() {}));