Make sure only toStringTag is used for Object.prototype.toString with JSON / Math

BUG=

Review-Url: https://codereview.chromium.org/1992153002
Cr-Commit-Position: refs/heads/master@{#36393}

src/bootstrapper.cc

@@ -1587,7 +1587,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     Handle<JSFunction> cons = factory->NewFunction(name);
     JSFunction::SetInstancePrototype(cons,
         Handle<Object>(native_context()->initial_object_prototype(), isolate));
-    cons->shared()->set_instance_class_name(*name);
     Handle<JSObject> json_object = factory->NewJSObject(cons, TENURED);
     DCHECK(json_object->IsJSObject());
     JSObject::AddProperty(global, name, json_object, DONT_ENUM);
@@ -1599,7 +1598,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     JSFunction::SetInstancePrototype(
         cons,
         Handle<Object>(native_context()->initial_object_prototype(), isolate));
-    cons->shared()->set_instance_class_name(*name);
     Handle<JSObject> math = factory->NewJSObject(cons, TENURED);
     DCHECK(math->IsJSObject());
     JSObject::AddProperty(global, name, math, DONT_ENUM);

test/mjsunit/es6/json.js

@@ -9,5 +9,7 @@ function testJSONToString() {
   assertTrue(desc.configurable);
   assertFalse(desc.writable);
   assertEquals("JSON", desc.value);
+  delete JSON[Symbol.toStringTag];
+  assertEquals('[object Object]', "" + JSON);
 }
 testJSONToString();

test/mjsunit/es6/math.js

@@ -9,5 +9,7 @@ function testMathToString() {
   assertTrue(desc.configurable);
   assertFalse(desc.writable);
   assertEquals("Math", desc.value);
+  delete Math[Symbol.toStringTag];
+  assertEquals('[object Object]', "" + Math);
 }
 testMathToString();