[turbofan] Assign proper type to Object.prototype.toString().

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2652273003
Cr-Commit-Position: refs/heads/master@{#42691}

src/compiler/typer.cc

@@ -1505,6 +1505,8 @@ Type* Typer::Visitor::JSCallFunctionTyper(Type* fun, Typer* t) {
           return Type::OtherObject();
         case kObjectHasOwnProperty:
           return Type::Boolean();
+        case kObjectToString:
+          return Type::String();
 
         // RegExp functions.
         case kRegExpCompile:

src/objects.h

@@ -6996,6 +6996,7 @@ class Script: public Struct {
   V(Object, assign, ObjectAssign)                           \
   V(Object, create, ObjectCreate)                           \
   V(Object.prototype, hasOwnProperty, ObjectHasOwnProperty) \
+  V(Object.prototype, toString, ObjectToString)             \
   V(RegExp.prototype, compile, RegExpCompile)               \
   V(RegExp.prototype, exec, RegExpExec)                     \
   V(RegExp.prototype, test, RegExpTest)                     \