[builtins] Fix pointer comparison in ToString builtin.

test/mjsunit/regress/regress-crbug-664506.js

Index: test/mjsunit/regress/regress-crbug-664506.js
diff --git a/test/mjsunit/regress/regress-crbug-664506.js b/test/mjsunit/regress/regress-crbug-664506.js
new file mode 100644
index 0000000000000000000000000000000000000000..b0bf5e7591d4f4882e068875bb141b37809f904e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-664506.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --predictable --random-seed=-1109634722

[Michael Achenbach, 2016/11/14 13:40:10]

Hmm, I think the test suite always overrides random-seed. We'd need a new
feature to use the Flags version if present.

[Michael Starzinger, 2016/11/14 14:50:27]

Nope, I don't think that is true. The test suite adds a random-seed flag and
then appends the flag from the comment. That means the fixed random-seed
appearing here appears later in the command line and will win. Also I tried
locally when I wrote this regression test and it reproduces reliably. IMHO we
are fine. WDYT?

+
+gc();
+gc();
+assertEquals("[object Object]", Object.prototype.toString.call({}));
+gc();
+assertEquals("[object Array]", Object.prototype.toString.call([]));