Re-ship @@toStringTag

It was originally shipped in https://crrev.com/eef2b9b09723ba1dae3ec0172341e93e9030ada0,
but was reverted due to poor interaction with Blink.

That interaction seems to be fixed thanks to changes to the V8 API
and to @@toStringTag handling on access-checked objects.

BUG=v8:3502
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.v8:v8_linux_nosnap_rel;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1406293011

Cr-Commit-Position: refs/heads/master@{#31846}

src/flag-definitions.h

@@ -209,7 +209,6 @@ DEFINE_IMPLICATION(es_staging, harmony_destructuring)
   V(harmony_default_parameters, "harmony default parameters") \
   V(harmony_destructuring, "harmony destructuring")           \
   V(harmony_regexps, "harmony regular expression extensions") \
-  V(harmony_tostring, "harmony toString")                     \
   V(harmony_sloppy, "harmony features in sloppy mode")        \
   V(harmony_sloppy_let, "harmony let in sloppy mode")
 
@@ -220,6 +219,7 @@ DEFINE_IMPLICATION(es_staging, harmony_destructuring)
   V(harmony_rest_parameters, "harmony rest parameters")         \
   V(harmony_concat_spreadable, "harmony isConcatSpreadable")    \
   V(harmony_tolength, "harmony ToLength")                       \
+  V(harmony_tostring, "harmony toString")                       \
   V(harmony_completion, "harmony completion value semantics")
 
 // Once a shipping feature has proved stable in the wild, it will be dropped

test/cctest/test-api.cc

@@ -22038,11 +22038,21 @@ TEST(AccessCheckedToStringTag) {
   ExpectString("result", "[object hello]");
   ExpectString("object[Symbol.toStringTag]", "hello");
 
+  // ToString through the API should succeed too.
+  String::Utf8Value result_allowed(
+      object->ObjectProtoToString(env.local()).ToLocalChecked());
+  CHECK_EQ(0, strcmp(*result_allowed, "[object hello]"));
+
   // If access check fails, the value of @@toStringTag is ignored
   allowed_access = false;
   CompileRun("var result = Object.prototype.toString.call(object)");
   ExpectString("result", "[object Object]");
   ExpectTrue("object[Symbol.toStringTag] === undefined");
+
+  // ToString through the API should also fail.
+  String::Utf8Value result_denied(
+      object->ObjectProtoToString(env.local()).ToLocalChecked());
+  CHECK_EQ(0, strcmp(*result_denied, "[object Object]"));
 }