[objects] fix forced slow path in MigrateSlowToFast

Without this change, we could disable slow paths required when symbols
such as toStringTag are present on a receiver, but accessors or
interceptors are not (added in 31800120)

This change modifies this behaviour to not unset the previously set bit
if these forced slow path conditions are not met.

BUG=v8:7706
R=bmeurer@chromium.org

Change-Id: Id7bceb0e749da52e2dbcde0a310a865a89f24066
Reviewed-on: https://chromium-review.googlesource.com/1034210Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#52874}

src/objects.cc

@@ -6341,8 +6341,11 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
 
   // Allocate new map.
   Handle<Map> new_map = Map::CopyDropDescriptors(old_map);
-  new_map->set_may_have_interesting_symbols(new_map->has_named_interceptor() ||
-                                            new_map->is_access_check_needed());
+  if (new_map->has_named_interceptor() || new_map->is_access_check_needed()) {
+    // Force certain slow paths when API interceptors are used, or if an access
+    // check is required.
+    new_map->set_may_have_interesting_symbols(true);
+  }
   new_map->set_is_dictionary_map(false);
 
   NotifyMapChange(old_map, new_map, isolate);

src/objects/map.h

@@ -126,7 +126,8 @@ typedef std::vector<Handle<Map>> MapHandles;
 //      |          |   - elements_kind (bits 3..7)               |
 // +----+----------+---------------------------------------------+
 // | Int           | [bit_field3]                                |
-// |               |   - number_of_own_descriptors (bit 0..19)   |
+// |               |   - enum_length (bit 0..9)                  |
+// |               |   - number_of_own_descriptors (bit 10..19)  |
 // |               |   - is_dictionary_map (bit 20)              |
 // |               |   - owns_descriptors (bit 21)               |
 // |               |   - has_hidden_prototype (bit 22)           |

test/mjsunit/es6/regress/regress-7706.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class Test extends Number {}
+Test.prototype[Symbol.toStringTag] = "Test";
+
+assertEquals("[object Test]", Object.prototype.toString.call(new Test));
+
+%ToFastProperties(Test.prototype);
+assertEquals("[object Test]", Object.prototype.toString.call(new Test));