Implement ES6 Array.prototype.toString behind --harmony-tostring

test/mjsunit/es6/object-tostring.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-tostring
 
 var global = this;
 
 var funs = {
   Object:   [ Object ],
@@ skipping 113 matching lines @@
   new String("str")
 ].forEach(testToStringTagNonString);
 
 function testObjectToStringPropertyDesc() {
   var desc = Object.getOwnPropertyDescriptor(Object.prototype, "toString");
   assertTrue(desc.writable);
   assertFalse(desc.enumerable);
   assertTrue(desc.configurable);
 }
 testObjectToStringPropertyDesc();
+
+function testObjectToStringOwnNonStringValue() {
+  var obj = Object.defineProperty({}, Symbol.toStringTag, { value: 1 });
+  assertEquals("[object ???]", ({}).toString.call(obj));
+}
+testObjectToStringOwnNonStringValue();