[builtins] fix Torque fast-path for String.prototype.localeCompare

The fast path has an early return if the two inputs are the same
object. However, this was missing the check that the receiver
is not undefined required by the spec.
This fixes it by first checking that the receiver is a string and
only afterwards checking for reference equality.

Bug: v8:12495
Change-Id: I4c5fc80e09060b013c94b05bbc9da504ddbb5206
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3386602
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78637}

src/objects/intl-objects.tq

@@ -102,9 +102,9 @@ macro LocaleCompareFastPath<T1: type, T2: type>(
 transitioning builtin StringFastLocaleCompare(implicit context: Context)(
     localeCompareFn: JSFunction, left: JSAny, right: JSAny,
     locales: JSAny): JSAny {
-  if (TaggedEqual(left, right)) return SmiConstant(0);
   try {
     const left = Cast<String>(left) otherwise Bailout;
+    if (TaggedEqual(left, right)) return SmiConstant(0);
     StringToSlice(left) otherwise LeftOneByte, LeftTwoByte;
   } label LeftOneByte(leftSlice: ConstSlice<char8>) {
     try {

test/mjsunit/regress/regress-12495.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt() {
+  try {
+    Reflect.apply("".localeCompare, undefined, [undefined]);
+    return false;
+  } catch(e) {
+    return true;
+  }
+}
+
+%PrepareFunctionForOptimization(opt);
+assertTrue(opt());
+assertTrue(opt());
+%OptimizeFunctionOnNextCall(opt);
+assertTrue(opt());
+assertTrue(opt());