[crankshaft] Handle @@toStringTag accessor correctly for BuildCompareInstruction.
authorbmeurer <bmeurer@chromium.org>
Tue, 22 Sep 2015 04:07:53 +0000 (21:07 -0700)
committerCommit bot <commit-bot@chromium.org>
Tue, 22 Sep 2015 04:08:08 +0000 (04:08 +0000)
commit3d7c45371e26a3ca7b688ed73892cba44cb23c0d
tree943841fcdd9f22ab7eb7c9c03f1bd0795e9e7dfd
parent9308f8f95baa69542ee3a4649be7efdd8db6eb7a
[crankshaft] Handle @@toStringTag accessor correctly for BuildCompareInstruction.

If @@toStringTag is an accessor property, we cannot assume that the result
of calling Object.prototype.toString() for objects with the same map.

R=adamk@chromium.org
BUG=chromium:534200
LOG=n

Review URL: https://codereview.chromium.org/1360723002

Cr-Commit-Position: refs/heads/master@{#30856}
src/hydrogen.cc
test/mjsunit/compare-known-objects-tostringtag.js [new file with mode: 0644]