Fix NoSideEffectToString.

src/messages.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // -------------------------------------------------------------------
 
 var kMessages = {
   // Error
   cyclic_proto:                  ["Cyclic __proto__ value"],
   code_gen_from_strings:         ["%0"],
@@ skipping 205 matching lines @@
   if (IS_NULL(obj)) return 'null';
   if (IS_FUNCTION(obj)) {
     var str = %_CallFunction(obj, FunctionToString);
     if (str.length > 128) {
       str = %_SubString(str, 0, 111) + "...<omitted>..." +
             %_SubString(str, str.length - 2, str.length);
     }
     return str;
   }
   if (IS_SYMBOL(obj)) return %_CallFunction(obj, SymbolToString);
-  if (IS_OBJECT(obj) && %GetDataProperty(obj, "toString") === ObjectToString) {
+  if (CanBeSafelyTreatedAsAnErrorObject(obj)) {
+    return %_CallFunction(obj, ErrorToString);
+  }
+  if (IS_OBJECT(obj)) {

[caitp (gmail), 2014/10/21 01:09:37]

So, this will cause arrays to always be reported as `#<Array>` rather than
`[object Array]` --- I'm not sure if that's the right behaviour or not ---
probably doesn't matter a whole lot, but it might be reported as a regression.
Same thing for similar cases where the `toString` function is overridden
somewhere in the prototype chain.

Maybe a better solution is to change the toStringTag CL to make this check for
both default ObjectToString functions?

     var constructor = %GetDataProperty(obj, "constructor");
     if (typeof constructor == "function") {
       var constructorName = constructor.name;
       if (IS_STRING(constructorName) && constructorName !== "") {
         return "#<" + constructorName + ">";
       }
     }
   }
-  if (CanBeSafelyTreatedAsAnErrorObject(obj)) {
-    return %_CallFunction(obj, ErrorToString);
-  }
   return %_CallFunction(obj, ObjectToString);
 }
 
 // To determine whether we can safely stringify an object using ErrorToString
 // without the risk of side-effects, we need to check whether the object is
 // either an instance of a native error type (via '%_ClassOf'), or has $Error
 // in its prototype chain and hasn't overwritten 'toString' with something
 // strange and unusual.
 function CanBeSafelyTreatedAsAnErrorObject(obj) {
   switch (%_ClassOf(obj)) {
@@ skipping 1052 matching lines @@
 function SetUpStackOverflowBoilerplate() {
   var boilerplate = MakeRangeError('stack_overflow', []);
 
   %DefineAccessorPropertyUnchecked(
       boilerplate, 'stack', StackTraceGetter, StackTraceSetter, DONT_ENUM);
 
   return boilerplate;
 }
 
 var kStackOverflowBoilerplate = SetUpStackOverflowBoilerplate();