Date() should not depend on Date.prototype.toString

We used to call toString as a method which is not safe.

BUG=v8:4225
LOG=Y
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1200033003

Cr-Commit-Position: refs/heads/master@{#29242}

src/date.js

@@ -133,7 +133,7 @@ var Date_cache = {
 function DateConstructor(year, month, date, hours, minutes, seconds, ms) {
   if (!%_IsConstructCall()) {
     // ECMA 262 - 15.9.2
-    return (new GlobalDate()).toString();
+    return %_CallFunction(new GlobalDate(), DateToString);
   }
 
   // ECMA 262 - 15.9.3

test/mjsunit/date.js

@@ -349,3 +349,8 @@ delete Date.prototype.getUTCMinutes;
 delete Date.prototype.getUTCSeconds;
 delete Date.prototype.getUTCMilliseconds;
 date.toISOString();
+
+(function TestDeleteToString() {
+  assertTrue(delete Date.prototype.toString);
+  assertTrue('[object Date]' !== Date());
+})();