• Mythri's avatar
    Fix ObjectToString builtin to work for subclasses · 2ea00908
    Mythri authored
    When we call ObjectToString on JSValues we only looked at string tags
    on the prototype map of the JSValue's value type and do not check the
    tags on the JSValue's prototype chain which may be non-trivial if
    subclassing is involved. For ex: if we have a class Test extend Number,
    we only looked for tags on the Number prototype and not on the Test
    prototype. This cl fixes the builtin to also check for these cases.
    
    
    Bug: v8:7706
    Change-Id: I9f0e3bb6499646bf27b92bf4fb4e9014f6efa56b
    Reviewed-on: https://chromium-review.googlesource.com/c/1378176Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
    Commit-Queue: Mythri Alle <mythria@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#58338}
    2ea00908
regress-7706.js 1.57 KB