Object.prototype.toString must reflect mutated @@toStringTag values for primitives

src/builtins/builtins-object.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/property-descriptor.h"
 
@@ skipping 240 matching lines @@
       assembler->factory()->NewStringFromStaticChars("]"));
 
   Callable callable = CodeFactory::StringAdd(
       assembler->isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
 
   assembler->Return(assembler->CallStub(
       callable, context, assembler->CallStub(callable, context, lhs, string),
       rhs));
 }
 
-void ReturnIfPrimitive(CodeStubAssembler* assembler,
-                       compiler::Node* instance_type,
-                       CodeStubAssembler::Label* return_string,
-                       CodeStubAssembler::Label* return_boolean,
-                       CodeStubAssembler::Label* return_number) {
-  assembler->GotoIf(assembler->IsStringInstanceType(instance_type),
-                    return_string);
-
-  assembler->GotoIf(assembler->Word32Equal(
-                        instance_type, assembler->Int32Constant(ODDBALL_TYPE)),
-                    return_boolean);
-
-  assembler->GotoIf(
-      assembler->Word32Equal(instance_type,
-                             assembler->Int32Constant(HEAP_NUMBER_TYPE)),
-      return_number);
-}
-
 }  // namespace
 
 // ES6 section 19.1.3.6 Object.prototype.toString
 void Builtins::Generate_ObjectProtoToString(
     compiler::CodeAssemblerState* state) {
   typedef compiler::Node Node;
   typedef CodeStubAssembler::Label Label;
   typedef CodeStubAssembler::Variable Variable;
   CodeStubAssembler assembler(state);
 
   Label return_undefined(&assembler, Label::kDeferred),
       return_null(&assembler, Label::kDeferred),
       return_arguments(&assembler, Label::kDeferred), return_array(&assembler),
       return_api(&assembler, Label::kDeferred), return_object(&assembler),
       return_regexp(&assembler), return_function(&assembler),
       return_error(&assembler), return_date(&assembler),
-      return_string(&assembler), return_boolean(&assembler),
-      return_jsvalue(&assembler), return_jsproxy(&assembler, Label::kDeferred),
-      return_number(&assembler);
+      return_jsvalue(&assembler), return_jsproxy(&assembler, Label::kDeferred);
 
   Label if_isproxy(&assembler, Label::kDeferred);
 
   Label checkstringtag(&assembler);
   Label if_tostringtag(&assembler), if_notostringtag(&assembler);
 
   Node* receiver = assembler.Parameter(0);
   Node* context = assembler.Parameter(3);
 
   assembler.GotoIf(assembler.WordEqual(receiver, assembler.UndefinedConstant()),
                    &return_undefined);
 
   assembler.GotoIf(assembler.WordEqual(receiver, assembler.NullConstant()),
                    &return_null);
 
-  assembler.GotoIf(assembler.TaggedIsSmi(receiver), &return_number);
+  Callable to_object = CodeFactory::ToObject(assembler.isolate());
+  receiver = assembler.CallStub(to_object, context, receiver);
 
   Node* receiver_instance_type = assembler.LoadInstanceType(receiver);
-  ReturnIfPrimitive(&assembler, receiver_instance_type, &return_string,
-                    &return_boolean, &return_number);
 
   // for proxies, check IsArray before getting @@toStringTag
   Variable var_proxy_is_array(&assembler, MachineRepresentation::kTagged);
   var_proxy_is_array.Bind(assembler.BooleanConstant(false));
 
   assembler.Branch(
       assembler.Word32Equal(receiver_instance_type,
                             assembler.Int32Constant(JS_PROXY_TYPE)),
       &if_isproxy, &checkstringtag);
 
@@ skipping 54 matching lines @@
                      case_labels, arraysize(case_values));
 
     assembler.Bind(&return_undefined);
     assembler.Return(assembler.HeapConstant(
         assembler.isolate()->factory()->undefined_to_string()));
 
     assembler.Bind(&return_null);
     assembler.Return(assembler.HeapConstant(
         assembler.isolate()->factory()->null_to_string()));
 
-    assembler.Bind(&return_number);
-    assembler.Return(assembler.HeapConstant(
-        assembler.isolate()->factory()->number_to_string()));
-
-    assembler.Bind(&return_string);
-    assembler.Return(assembler.HeapConstant(
-        assembler.isolate()->factory()->string_to_string()));
-
-    assembler.Bind(&return_boolean);
-    assembler.Return(assembler.HeapConstant(
-        assembler.isolate()->factory()->boolean_to_string()));
-
     assembler.Bind(&return_arguments);
     assembler.Return(assembler.HeapConstant(
         assembler.isolate()->factory()->arguments_to_string()));
 
     assembler.Bind(&return_array);
     assembler.Return(assembler.HeapConstant(
         assembler.isolate()->factory()->array_to_string()));
 
     assembler.Bind(&return_function);
     assembler.Return(assembler.HeapConstant(
@@ skipping 13 matching lines @@
 
     assembler.Bind(&return_api);
     {
       Node* class_name =
           assembler.CallRuntime(Runtime::kClassOf, context, receiver);
       ReturnToStringFormat(&assembler, context, class_name);
     }
 
     assembler.Bind(&return_jsvalue);
     {
+      Label return_boolean(&assembler), return_number(&assembler),
+          return_string(&assembler);
+
       Node* value = assembler.LoadJSValueValue(receiver);
       assembler.GotoIf(assembler.TaggedIsSmi(value), &return_number);
+      Node* instance_type = assembler.LoadInstanceType(value);
 
-      ReturnIfPrimitive(&assembler, assembler.LoadInstanceType(value),
-                        &return_string, &return_boolean, &return_number);
+      assembler.GotoIf(assembler.IsStringInstanceType(instance_type),
+                       &return_string);
+      assembler.GotoIf(
+          assembler.Word32Equal(instance_type,
+                                assembler.Int32Constant(HEAP_NUMBER_TYPE)),
+          &return_number);
+      assembler.GotoIf(
+          assembler.Word32Equal(instance_type,
+                                assembler.Int32Constant(ODDBALL_TYPE)),
+          &return_boolean);
+
+      CSA_ASSERT(&assembler,
+                 assembler.Word32Equal(instance_type,
+                                       assembler.Int32Constant(SYMBOL_TYPE)));
       assembler.Goto(&return_object);
+
+      assembler.Bind(&return_string);
+      assembler.Return(assembler.HeapConstant(
+          assembler.isolate()->factory()->string_to_string()));
+
+      assembler.Bind(&return_number);
+      assembler.Return(assembler.HeapConstant(
+          assembler.isolate()->factory()->number_to_string()));
+
+      assembler.Bind(&return_boolean);
+      assembler.Return(assembler.HeapConstant(
+          assembler.isolate()->factory()->boolean_to_string()));
     }
 
     assembler.Bind(&return_jsproxy);
     {
       assembler.GotoIf(assembler.WordEqual(var_proxy_is_array.value(),
                                            assembler.BooleanConstant(true)),
                        &return_array);
 
       Node* map = assembler.LoadMap(receiver);
 
@@ skipping 652 matching lines @@
   CodeStubAssembler assembler(state);
 
   Node* object = assembler.Parameter(Descriptor::kObject);
   Node* context = assembler.Parameter(Descriptor::kContext);
 
   assembler.Return(assembler.GetSuperConstructor(object, context));
 }
 
 }  // namespace internal
 }  // namespace v8