[turbofan] Assign good types to Symbol.prototype.{toString,valueOf}.

Make the TurboFan Typer infer proper types for calls to the known
Symbol.prototype.toString() and Symbol.prototype.valueOf() builtins.

Bug: v8:8015
Change-Id: Ia133bd8f2cfcabaf984820a953b357d1747d6892
Reviewed-on: https://chromium-review.googlesource.com/1213203
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55719}

src/bootstrapper.cc

@@ -2192,9 +2192,11 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     // Install the Symbol.prototype methods.
     SimpleInstallFunction(isolate_, prototype, "toString",
-                          Builtins::kSymbolPrototypeToString, 0, true);
+                          Builtins::kSymbolPrototypeToString, 0, true,
+                          BuiltinFunctionId::kSymbolPrototypeToString);
     SimpleInstallFunction(isolate_, prototype, "valueOf",
-                          Builtins::kSymbolPrototypeValueOf, 0, true);
+                          Builtins::kSymbolPrototypeValueOf, 0, true,
+                          BuiltinFunctionId::kSymbolPrototypeValueOf);
 
     // Install the @@toPrimitive function.
     Handle<JSFunction> to_primitive = InstallFunction(

src/compiler/typer.cc

@@ -1495,6 +1495,10 @@ Type Typer::Visitor::JSCallTyper(Type fun, Typer* t) {
     // Symbol functions.
     case BuiltinFunctionId::kSymbolConstructor:
       return Type::Symbol();
+    case BuiltinFunctionId::kSymbolPrototypeToString:
+      return Type::String();
+    case BuiltinFunctionId::kSymbolPrototypeValueOf:
+      return Type::Symbol();
 
     // BigInt functions.
     case BuiltinFunctionId::kBigIntConstructor:

src/objects.h

@@ -3139,6 +3139,8 @@ enum class BuiltinFunctionId : uint8_t {
   kGlobalIsNaN,
   kNumberConstructor,
   kSymbolConstructor,
+  kSymbolPrototypeToString,
+  kSymbolPrototypeValueOf,
   kTypedArrayByteLength,
   kTypedArrayByteOffset,
   kTypedArrayEntries,