Attachment 372748 Details for Bug 199138 – Patch

[patch] Patch

bug-199138-20190624155345.patch (text/plain), 45.59 KB, created by Alexey Shvayka on 2019-06-24 05:53:47 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Alexey Shvayka

Created: 2019-06-24 05:53:47 PDT

Size: 45.59 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 246731)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.prototype.toString is not spec-perfect
>+        https://bugs.webkit.org/show_bug.cgi?id=199138
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * test262/expectations.yaml: Mark 2 test cases as passing.
>+        * wasm/spec-tests/jsapi.js: Check @@toStringTag values.
>+
> 2019-06-22  Robin Morisset  <rmorisset@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         All prototypes should call didBecomePrototype()
>Index: JSTests/test262/expectations.yaml
>===================================================================
>--- JSTests/test262/expectations.yaml	(revision 246731)
>+++ JSTests/test262/expectations.yaml	(working copy)
>@@ -1089,9 +1089,6 @@ test/built-ins/Object/keys/property-trap
> test/built-ins/Object/proto-from-ctor.js:
>   default: 'Test262Error: Expected SameValue(ÃÂ«[object Object]ÃÂ», ÃÂ«[object Object]ÃÂ») to be true'
>   strict mode: 'Test262Error: Expected SameValue(ÃÂ«[object Object]ÃÂ», ÃÂ«[object Object]ÃÂ») to be true'
>-test/built-ins/Object/prototype/toString/proxy-function.js:
>-  default: 'Test262Error: function proxy Expected SameValue(ÃÂ«[object Object]ÃÂ», ÃÂ«[object Function]ÃÂ») to be true'
>-  strict mode: 'Test262Error: function proxy Expected SameValue(ÃÂ«[object Object]ÃÂ», ÃÂ«[object Function]ÃÂ») to be true'
> test/built-ins/Object/subclass-object-arg.js:
>   default: 'Test262Error: Expected SameValue(ÃÂ«undefinedÃÂ», ÃÂ«1ÃÂ») to be true'
>   strict mode: 'Test262Error: Expected SameValue(ÃÂ«undefinedÃÂ», ÃÂ«1ÃÂ») to be true'
>Index: JSTests/wasm/spec-tests/jsapi.js
>===================================================================
>--- JSTests/wasm/spec-tests/jsapi.js	(revision 246731)
>+++ JSTests/wasm/spec-tests/jsapi.js	(working copy)
>@@ -120,7 +120,7 @@ test(() => {
> test(() => {
>     const wasmDesc = Object.getOwnPropertyDescriptor(this, 'WebAssembly');
>     assert_equals(WebAssembly, wasmDesc.value);
>-    assert_equals(String(WebAssembly), "[object WebAssembly]");
>+    assert_equals(WebAssembly[Symbol.toStringTag], "WebAssembly");
> }, "'WebAssembly' object");
> 
> test(() => {
>@@ -212,7 +212,7 @@ test(() => {
>     const moduleProtoDesc = Object.getOwnPropertyDescriptor(Module, 'prototype');
>     const moduleProto = Module.prototype;
>     assert_equals(moduleProto, moduleProtoDesc.value);
>-    assert_equals(String(moduleProto), "[object WebAssembly.Module]");
>+    assert_equals(moduleProto[Symbol.toStringTag], "WebAssembly.Module");
>     assert_equals(Object.getPrototypeOf(moduleProto), Object.prototype);
> }, "'WebAssembly.Module.prototype' object");
> 
>@@ -351,7 +351,7 @@ test(() => {
>     instanceProto = Instance.prototype;
>     const instanceProtoDesc = Object.getOwnPropertyDescriptor(Instance, 'prototype');
>     assert_equals(instanceProto, instanceProtoDesc.value);
>-    assert_equals(String(instanceProto), "[object WebAssembly.Instance]");
>+    assert_equals(instanceProto[Symbol.toStringTag], "WebAssembly.Instance");
>     assert_equals(Object.getPrototypeOf(instanceProto), Object.prototype);
> }, "'WebAssembly.Instance.prototype' object");
> 
>@@ -436,7 +436,7 @@ test(() => {
>     memoryProto = Memory.prototype;
>     const memoryProtoDesc = Object.getOwnPropertyDescriptor(Memory, 'prototype');
>     assert_equals(memoryProto, memoryProtoDesc.value);
>-    assert_equals(String(memoryProto), "[object WebAssembly.Memory]");
>+    assert_equals(memoryProto[Symbol.toStringTag], "WebAssembly.Memory");
>     assert_equals(Object.getPrototypeOf(memoryProto), Object.prototype);
> }, "'WebAssembly.Memory.prototype' object");
> 
>@@ -538,7 +538,7 @@ test(() => {
>     const tableProtoDesc = Object.getOwnPropertyDescriptor(Table, 'prototype');
>     tableProto = Table.prototype;
>     assert_equals(tableProto, tableProtoDesc.value);
>-    assert_equals(String(tableProto), "[object WebAssembly.Table]");
>+    assert_equals(tableProto[Symbol.toStringTag], "WebAssembly.Table");
>     assert_equals(Object.getPrototypeOf(tableProto), Object.prototype);
> }, "'WebAssembly.Table.prototype' object");
> 
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 246731)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,90 @@
>+2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.prototype.toString is not spec-perfect
>+        https://bugs.webkit.org/show_bug.cgi?id=199138
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Before @@toStringTag was introduced, Object#toString relied solely on internal [[Class]] slot.
>+        Starting with ES6, newly introduced built-ins and DOM objects provide @@toStringTag for Object#toString to use.
>+        With @@toStringTag removed, Object#toString should not special-case them and return "[object Object]".
>+        Per current spec, Object#toString examines only a handful of internal slots for backwards compatibility.
>+
>+        Object#toString in JSC still relies on JSObject::className a.k.a. [[Class]] for all classes.
>+        For (almost all) new built-ins, it gets overriden by `toStringName` that returns "Object".
>+        This is quite error-prone approach and is observable spec discrepancy if @@toStringTag is deleted or set to non-string.
>+
>+        This change aligns both algorithm and results of Object#toString with the specification.
>+        (https://tc39.es/ecma262/#sec-object.prototype.tostring)
>+
>+        1. Changes JSObject::toStringName to return either "Function" or "Object" instead of `className`.
>+        2. Adds `toStringName` overrides to pre-ES6 classes: Boolean, Arguments, Date, Arguments, Error, Number, RegExp, and String.
>+        3. Adds `isArray` check to `objectProtoFuncToString` for Proxy detection.
>+        4. Adds @@toStringTag to WebAssembly constructors.
>+        5. Adds @@toStringTag to DOM constructors, prototypes, and iterators.
>+        6. Removes now useless "Object" overrides for BigInt, ArrayBuffer, Map, Set, WeakMap, WeakRef, and WeakSet.
>+        7. Removes now useless ProxyObject::toStringName.
>+
>+        * jsc.cpp:
>+        (GlobalObject::toStringName):
>+        * runtime/BigIntObject.cpp:
>+        (JSC::BigIntObject::toStringName): Deleted.
>+        * runtime/BigIntObject.h:
>+        * runtime/BooleanObject.h:
>+        (JSC::BooleanObject::toStringName):
>+        * runtime/ClonedArguments.h:
>+        * runtime/ConsoleObject.h:
>+        * runtime/DateInstance.h:
>+        * runtime/DirectArguments.h:
>+        * runtime/ErrorInstance.h:
>+        (JSC::ErrorInstance::toStringName):
>+        * runtime/JSArray.cpp:
>+        (JSC::JSArray::toStringName):
>+        * runtime/JSArray.h:
>+        * runtime/JSArrayBufferView.cpp:
>+        (JSC::JSArrayBufferView::toStringName): Deleted.
>+        * runtime/JSArrayBufferView.h:
>+        * runtime/JSMap.cpp:
>+        (JSC::JSMap::toStringName): Deleted.
>+        * runtime/JSMap.h:
>+        * runtime/JSObject.cpp:
>+        (JSC::JSObject::toStringName):
>+        * runtime/JSSet.cpp:
>+        (JSC::JSSet::toStringName): Deleted.
>+        * runtime/JSSet.h:
>+        * runtime/JSWeakMap.cpp:
>+        (JSC::JSWeakMap::toStringName): Deleted.
>+        * runtime/JSWeakMap.h:
>+        * runtime/JSWeakObjectRef.cpp:
>+        (JSC::JSWeakObjectRef::toStringName): Deleted.
>+        * runtime/JSWeakObjectRef.h:
>+        * runtime/JSWeakSet.cpp:
>+        (JSC::JSWeakSet::toStringName): Deleted.
>+        * runtime/JSWeakSet.h:
>+        * runtime/NumberObject.h:
>+        (JSC::NumberObject::toStringName):
>+        * runtime/ObjectPrototype.cpp:
>+        (JSC::objectProtoFuncToString):
>+        * runtime/ProxyObject.cpp:
>+        (JSC::ProxyObject::toStringName): Deleted.
>+        * runtime/ProxyObject.h:
>+        * runtime/RegExpObject.h:
>+        * runtime/StringObject.h:
>+        (JSC::StringObject::toStringName):
>+        * runtime/SymbolObject.cpp:
>+        (JSC::SymbolObject::toStringName): Deleted.
>+        * runtime/SymbolObject.h:
>+        * wasm/js/JSWebAssembly.cpp:
>+        (JSC::JSWebAssembly::finishCreation):
>+        * wasm/js/WebAssemblyInstancePrototype.cpp:
>+        (JSC::WebAssemblyInstancePrototype::finishCreation):
>+        * wasm/js/WebAssemblyMemoryPrototype.cpp:
>+        (JSC::WebAssemblyMemoryPrototype::finishCreation):
>+        * wasm/js/WebAssemblyModulePrototype.cpp:
>+        (JSC::WebAssemblyModulePrototype::finishCreation):
>+        * wasm/js/WebAssemblyTablePrototype.cpp:
>+        (JSC::WebAssemblyTablePrototype::finishCreation):
>+
> 2019-06-22  Robin Morisset  <rmorisset@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         All prototypes should call didBecomePrototype()
>Index: Source/JavaScriptCore/jsc.cpp
>===================================================================
>--- Source/JavaScriptCore/jsc.cpp	(revision 246731)
>+++ Source/JavaScriptCore/jsc.cpp	(working copy)
>@@ -493,6 +493,7 @@ public:
>         return Structure::create(vm, 0, prototype, TypeInfo(GlobalObjectType, StructureFlags), info());
>     }
> 
>+    static String toStringName(const JSObject*, ExecState*) { return "global"_s; }
>     static RuntimeFlags javaScriptRuntimeFlags(const JSGlobalObject*) { return RuntimeFlags::createAllEnabled(); }
> 
> protected:
>Index: Source/JavaScriptCore/runtime/BigIntObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/BigIntObject.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/BigIntObject.cpp	(working copy)
>@@ -56,11 +56,6 @@ void BigIntObject::finishCreation(VM& vm
>     setInternalValue(vm, bigInt);
> }
> 
>-String BigIntObject::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> JSValue BigIntObject::defaultValue(const JSObject* object, ExecState*, PreferredPrimitiveType)
> {
>     const BigIntObject* bigIntObject = jsCast<const BigIntObject*>(object);
>Index: Source/JavaScriptCore/runtime/BigIntObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/BigIntObject.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/BigIntObject.h	(working copy)
>@@ -48,8 +48,6 @@ public:
> 
>     static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
> 
>-    static String toStringName(const JSObject*, ExecState*);
>-
> protected:
>     JS_EXPORT_PRIVATE void finishCreation(VM&, JSBigInt*);
>     JS_EXPORT_PRIVATE BigIntObject(VM&, Structure*);
>Index: Source/JavaScriptCore/runtime/BooleanObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/BooleanObject.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/BooleanObject.h	(working copy)
>@@ -45,6 +45,8 @@ public:
>     {
>         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
>     }
>+
>+    static String toStringName(const JSObject*, ExecState*) { return "Boolean"_s; }
> };
> 
> } // namespace JSC
>Index: Source/JavaScriptCore/runtime/ClonedArguments.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ClonedArguments.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/ClonedArguments.h	(working copy)
>@@ -56,6 +56,7 @@ public:
>     static Structure* createSlowPutStructure(VM&, JSGlobalObject*, JSValue prototype);
> 
>     static void visitChildren(JSCell*, SlotVisitor&);
>+    static String toStringName(const JSObject*, ExecState*) { return "Arguments"_s; }
> 
>     DECLARE_INFO;
> 
>Index: Source/JavaScriptCore/runtime/ConsoleObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ConsoleObject.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/ConsoleObject.h	(working copy)
>@@ -50,6 +50,8 @@ public:
>         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
>     }
> 
>+    static String toStringName(const JSObject*, ExecState*) { return "Console"_s; }
>+
> protected:
>     void finishCreation(VM&, JSGlobalObject*);
> };
>Index: Source/JavaScriptCore/runtime/DateInstance.h
>===================================================================
>--- Source/JavaScriptCore/runtime/DateInstance.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/DateInstance.h	(working copy)
>@@ -73,6 +73,8 @@ public:
>         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
>     }
> 
>+    static String toStringName(const JSObject*, ExecState*) { return "Date"_s; }
>+
> private:
>     JS_EXPORT_PRIVATE const GregorianDateTime* calculateGregorianDateTime(ExecState*) const;
>     JS_EXPORT_PRIVATE const GregorianDateTime* calculateGregorianDateTimeUTC(ExecState*) const;
>Index: Source/JavaScriptCore/runtime/DirectArguments.h
>===================================================================
>--- Source/JavaScriptCore/runtime/DirectArguments.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/DirectArguments.h	(working copy)
>@@ -170,6 +170,8 @@ public:
>     {
>         return offsetOfSlot(capacity);
>     }
>+
>+    static String toStringName(const JSObject*, ExecState*) { return "Arguments"_s; }
>     
> private:
>     WriteBarrier<Unknown>* storage()
>Index: Source/JavaScriptCore/runtime/ErrorInstance.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ErrorInstance.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/ErrorInstance.h	(working copy)
>@@ -51,6 +51,7 @@ public:
>     }
> 
>     static ErrorInstance* create(ExecState*, Structure*, JSValue message, SourceAppender = nullptr, RuntimeType = TypeNothing, bool useCurrentFrame = true);
>+    static String toStringName(const JSObject*, ExecState*) { return "Error"_s; }
> 
>     bool hasSourceAppender() const { return !!m_sourceAppender; }
>     SourceAppender sourceAppender() const { return m_sourceAppender; }
>Index: Source/JavaScriptCore/runtime/JSArray.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArray.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSArray.cpp	(working copy)
>@@ -43,6 +43,7 @@ STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(
> 
> const ClassInfo JSArray::s_info = {"Array", &JSNonFinalObject::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSArray)};
> 
>+String JSArray::toStringName(const JSObject*, ExecState*) { return "Array"_s; }
> JSArray* JSArray::tryCreateUninitializedRestricted(ObjectInitializationScope& scope, GCDeferralContext* deferralContext, Structure* structure, unsigned initialLength)
> {
>     VM& vm = scope.vm();
>Index: Source/JavaScriptCore/runtime/JSArray.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArray.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSArray.h	(working copy)
>@@ -171,6 +171,8 @@ public:
>     {
>         return Structure::create(vm, globalObject, prototype, TypeInfo(ArrayType, StructureFlags), info(), indexingType);
>     }
>+
>+    JS_EXPORT_PRIVATE static String toStringName(const JSObject*, ExecState*);
>         
> protected:
>     void finishCreation(VM& vm)
>Index: Source/JavaScriptCore/runtime/JSArrayBufferView.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArrayBufferView.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSArrayBufferView.cpp	(working copy)
>@@ -42,11 +42,6 @@ const ClassInfo JSArrayBufferView::s_inf
>     "ArrayBufferView", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSArrayBufferView)
> };
> 
>-String JSArrayBufferView::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> JSArrayBufferView::ConstructionContext::ConstructionContext(
>     Structure* structure, uint32_t length, void* vector)
>     : m_structure(structure)
>Index: Source/JavaScriptCore/runtime/JSArrayBufferView.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArrayBufferView.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSArrayBufferView.h	(working copy)
>@@ -193,8 +193,6 @@ protected:
> 
>     ArrayBuffer* existingBufferInButterfly();
> 
>-    static String toStringName(const JSObject*, ExecState*);
>-
>     VectorPtr m_vector;
>     uint32_t m_length;
>     TypedArrayMode m_mode;
>Index: Source/JavaScriptCore/runtime/JSMap.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSMap.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSMap.cpp	(working copy)
>@@ -33,11 +33,6 @@ namespace JSC {
> 
> const ClassInfo JSMap::s_info = { "Map", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSMap) };
> 
>-String JSMap::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> JSMap* JSMap::clone(ExecState* exec, VM& vm, Structure* structure)
> {
>     JSMap* instance = new (NotNull, allocateCell<JSMap>(vm.heap)) JSMap(vm, structure);
>Index: Source/JavaScriptCore/runtime/JSMap.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSMap.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSMap.h	(working copy)
>@@ -62,8 +62,6 @@ private:
>         : Base(vm, structure)
>     {
>     }
>-
>-    static String toStringName(const JSObject*, ExecState*);
> };
> 
> static_assert(std::is_final<JSMap>::value, "Required for JSType based casting");
>Index: Source/JavaScriptCore/runtime/JSObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSObject.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSObject.cpp	(working copy)
>@@ -518,10 +518,7 @@ String JSObject::className(const JSObjec
> 
> String JSObject::toStringName(const JSObject* object, ExecState* exec)
> {
>-    VM& vm = exec->vm();
>-    const ClassInfo* info = object->classInfo(vm);
>-    ASSERT(info);
>-    return info->className;
>+    return const_cast<JSObject*>(object)->isFunction(exec->vm()) ? "Function"_s : "Object"_s;
> }
> 
> String JSObject::calculatedClassName(JSObject* object)
>Index: Source/JavaScriptCore/runtime/JSSet.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSSet.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSSet.cpp	(working copy)
>@@ -33,11 +33,6 @@ namespace JSC {
> 
> const ClassInfo JSSet::s_info = { "Set", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSSet) };
> 
>-String JSSet::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> JSSet* JSSet::clone(ExecState* exec, VM& vm, Structure* structure)
> {
>     JSSet* instance = new (NotNull, allocateCell<JSSet>(vm.heap)) JSSet(vm, structure);
>Index: Source/JavaScriptCore/runtime/JSSet.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSSet.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSSet.h	(working copy)
>@@ -67,8 +67,6 @@ private:
>         : Base(vm, structure, sizeHint)
>     {
>     }
>-
>-    static String toStringName(const JSObject*, ExecState*);
> };
> 
> static_assert(std::is_final<JSSet>::value, "Required for JSType based casting");
>Index: Source/JavaScriptCore/runtime/JSWeakMap.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakMap.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSWeakMap.cpp	(working copy)
>@@ -32,9 +32,4 @@ namespace JSC {
> 
> const ClassInfo JSWeakMap::s_info = { "WeakMap", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSWeakMap) };
> 
>-String JSWeakMap::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> }
>Index: Source/JavaScriptCore/runtime/JSWeakMap.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakMap.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSWeakMap.h	(working copy)
>@@ -58,8 +58,6 @@ private:
>         : Base(vm, structure)
>     {
>     }
>-
>-    static String toStringName(const JSObject*, ExecState*);
> };
> 
> static_assert(std::is_final<JSWeakMap>::value, "Required for JSType based casting");
>Index: Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp	(working copy)
>@@ -57,10 +57,5 @@ void JSWeakObjectRef::finalizeUnconditio
>         m_value.clear();
> }
> 
>-String JSWeakObjectRef::toStringName(const JSC::JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> }
> 
>Index: Source/JavaScriptCore/runtime/JSWeakObjectRef.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakObjectRef.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSWeakObjectRef.h	(working copy)
>@@ -75,8 +75,6 @@ private:
> 
>     JS_EXPORT_PRIVATE void finishCreation(VM&, JSObject* value);
> 
>-    static String toStringName(const JSObject*, ExecState*);
>-
>     uintptr_t m_lastAccessVersion;
>     WriteBarrier<JSObject> m_value;
> };
>Index: Source/JavaScriptCore/runtime/JSWeakSet.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakSet.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSWeakSet.cpp	(working copy)
>@@ -32,9 +32,4 @@ namespace JSC {
> 
> const ClassInfo JSWeakSet::s_info = { "WeakSet", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSWeakSet) };
> 
>-String JSWeakSet::toStringName(const JSC::JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> }
>Index: Source/JavaScriptCore/runtime/JSWeakSet.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakSet.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/JSWeakSet.h	(working copy)
>@@ -53,8 +53,6 @@ private:
>         : Base(vm, structure)
>     {
>     }
>-
>-    static String toStringName(const JSObject*, ExecState*);
> };
> 
> static_assert(std::is_final<JSWeakSet>::value, "Required for JSType based casting");
>Index: Source/JavaScriptCore/runtime/NumberObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/NumberObject.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/NumberObject.h	(working copy)
>@@ -45,6 +45,8 @@ public:
>     {
>         return Structure::create(vm, globalObject, prototype, TypeInfo(NumberObjectType, StructureFlags), info());
>     }
>+
>+    static String toStringName(const JSObject*, ExecState*) { return "Number"_s; }
> };
> 
> JS_EXPORT_PRIVATE NumberObject* constructNumber(ExecState*, JSGlobalObject*, JSValue);
>Index: Source/JavaScriptCore/runtime/ObjectPrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/ObjectPrototype.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/ObjectPrototype.cpp	(working copy)
>@@ -21,6 +21,7 @@
> #include "config.h"
> #include "ObjectPrototype.h"
> 
>+#include "ArrayConstructor.h"
> #include "Error.h"
> #include "GetterSetter.h"
> #include "HasOwnPropertyCache.h"
>@@ -339,7 +340,9 @@ EncodedJSValue JSC_HOST_CALL objectProto
>             }
>         }
> 
>-        String tag = thisObject->methodTable(vm)->toStringName(thisObject, exec);
>+        bool thisIsArray = isArray(exec, thisObject);
>+        RETURN_IF_EXCEPTION(scope, { });
>+        String tag = thisIsArray ? "Array"_s : thisObject->methodTable(vm)->toStringName(thisObject, exec);
>         RETURN_IF_EXCEPTION(scope, { });
>         String newString = tryMakeString("[object ", WTFMove(tag), "]");
>         if (!newString)
>Index: Source/JavaScriptCore/runtime/ProxyObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/ProxyObject.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/ProxyObject.cpp	(working copy)
>@@ -26,7 +26,6 @@
> #include "config.h"
> #include "ProxyObject.h"
> 
>-#include "ArrayConstructor.h"
> #include "Error.h"
> #include "IdentifierInlines.h"
> #include "JSCInlines.h"
>@@ -51,24 +50,6 @@ ProxyObject::ProxyObject(VM& vm, Structu
> {
> }
> 
>-String ProxyObject::toStringName(const JSObject* object, ExecState* exec)
>-{
>-    VM& vm = exec->vm();
>-    auto scope = DECLARE_THROW_SCOPE(vm);
>-    const ProxyObject* proxy = jsCast<const ProxyObject*>(object);
>-    while (proxy) {
>-        const JSObject* target = proxy->target();
>-        bool targetIsArray = isArray(exec, target);
>-        if (UNLIKELY(scope.exception()))
>-            break;
>-        if (targetIsArray)
>-            RELEASE_AND_RETURN(scope, target->classInfo(vm)->methodTable.toStringName(target, exec));
>-
>-        proxy = jsDynamicCast<const ProxyObject*>(vm, target);
>-    }
>-    return "Object"_s;
>-}
>-
> Structure* ProxyObject::structureForTarget(JSGlobalObject* globalObject, JSValue target)
> {
>     if (!target.isObject())
>Index: Source/JavaScriptCore/runtime/ProxyObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ProxyObject.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/ProxyObject.h	(working copy)
>@@ -74,7 +74,6 @@ private:
>     JS_EXPORT_PRIVATE void finishCreation(VM&, ExecState*, JSValue target, JSValue handler);
>     JS_EXPORT_PRIVATE static Structure* structureForTarget(JSGlobalObject*, JSValue target);
> 
>-    static String toStringName(const JSObject*, ExecState*);
>     static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
>     static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&);
>     static CallType getCallData(JSCell*, CallData&);
>Index: Source/JavaScriptCore/runtime/RegExpObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/RegExpObject.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/RegExpObject.h	(working copy)
>@@ -48,6 +48,8 @@ public:
>         return object;
>     }
> 
>+    static String toStringName(const JSObject*, ExecState*) { return "RegExp"_s; }
>+
>     void setRegExp(VM& vm, RegExp* regExp)
>     {
>         uintptr_t result = (m_regExpAndLastIndexIsNotWritableFlag & lastIndexIsNotWritableFlag) | bitwise_cast<uintptr_t>(regExp);
>Index: Source/JavaScriptCore/runtime/StringObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/StringObject.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/StringObject.h	(working copy)
>@@ -66,6 +66,8 @@ public:
>         return Structure::create(vm, globalObject, prototype, TypeInfo(StringObjectType, StructureFlags), info());
>     }
> 
>+    static String toStringName(const JSObject*, ExecState*) { return "String"_s; }
>+
> protected:
>     JS_EXPORT_PRIVATE void finishCreation(VM&, JSString*);
>     JS_EXPORT_PRIVATE StringObject(VM&, Structure*);
>Index: Source/JavaScriptCore/runtime/SymbolObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/SymbolObject.cpp	(revision 246731)
>+++ Source/JavaScriptCore/runtime/SymbolObject.cpp	(working copy)
>@@ -47,11 +47,6 @@ void SymbolObject::finishCreation(VM& vm
>     setInternalValue(vm, symbol);
> }
> 
>-String SymbolObject::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> JSValue SymbolObject::defaultValue(const JSObject* object, ExecState*, PreferredPrimitiveType)
> {
>     const SymbolObject* symbolObject = jsCast<const SymbolObject*>(object);
>Index: Source/JavaScriptCore/runtime/SymbolObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/SymbolObject.h	(revision 246731)
>+++ Source/JavaScriptCore/runtime/SymbolObject.h	(working copy)
>@@ -56,8 +56,6 @@ public:
> 
>     static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
> 
>-    static String toStringName(const JSObject*, ExecState*);
>-
> protected:
>     JS_EXPORT_PRIVATE void finishCreation(VM&, Symbol*);
>     JS_EXPORT_PRIVATE SymbolObject(VM&, Structure*);
>Index: Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp
>===================================================================
>--- Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp	(revision 246731)
>+++ Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp	(working copy)
>@@ -82,6 +82,7 @@ void JSWebAssembly::finishCreation(VM& v
> {
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WebAssembly"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
> }
> 
> JSWebAssembly::JSWebAssembly(VM& vm, Structure* structure)
>Index: Source/JavaScriptCore/wasm/js/WebAssemblyInstancePrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/wasm/js/WebAssemblyInstancePrototype.cpp	(revision 246731)
>+++ Source/JavaScriptCore/wasm/js/WebAssemblyInstancePrototype.cpp	(working copy)
>@@ -87,6 +87,7 @@ void WebAssemblyInstancePrototype::finis
> {
>     Base::finishCreation(vm);
>     didBecomePrototype();
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WebAssembly.Instance"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
> }
> 
> WebAssemblyInstancePrototype::WebAssemblyInstancePrototype(VM& vm, Structure* structure)
>Index: Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp	(revision 246731)
>+++ Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp	(working copy)
>@@ -110,6 +110,7 @@ void WebAssemblyMemoryPrototype::finishC
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
>     didBecomePrototype();
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WebAssembly.Memory"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
> }
> 
> WebAssemblyMemoryPrototype::WebAssemblyMemoryPrototype(VM& vm, Structure* structure)
>Index: Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.cpp	(revision 246731)
>+++ Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.cpp	(working copy)
>@@ -57,6 +57,7 @@ void WebAssemblyModulePrototype::finishC
> {
>     Base::finishCreation(vm);
>     didBecomePrototype();
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WebAssembly.Module"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
> }
> 
> WebAssemblyModulePrototype::WebAssemblyModulePrototype(VM& vm, Structure* structure)
>Index: Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp	(revision 246731)
>+++ Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp	(working copy)
>@@ -167,6 +167,7 @@ void WebAssemblyTablePrototype::finishCr
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
>     didBecomePrototype();
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WebAssembly.Table"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
> }
> 
> WebAssemblyTablePrototype::WebAssemblyTablePrototype(VM& vm, Structure* structure)
>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 246731)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,21 @@
>+2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.prototype.toString is not spec-perfect
>+        https://bugs.webkit.org/show_bug.cgi?id=199138
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Adds @@toStringTag to DOM constructors, prototypes, and iterators.
>+
>+        * bindings/js/JSDOMIterator.h:
>+        (WebCore::IteratorTraits>::finishCreation):
>+        * bindings/js/JSDOMWindowProperties.cpp:
>+        (WebCore::JSDOMWindowProperties::finishCreation):
>+        * bindings/js/JSDOMWindowProperties.h:
>+        * bindings/scripts/CodeGeneratorJS.pm:
>+        (GenerateImplementation):
>+        (GeneratePrototypeDeclaration):
>+
> 2019-06-24  Charlie Turner  <cturner@igalia.com>
> 
>         [GStreamer][MSE] Pausing video sometimes causes skip to finish
>Index: Source/WebCore/bindings/js/JSDOMIterator.h
>===================================================================
>--- Source/WebCore/bindings/js/JSDOMIterator.h	(revision 246731)
>+++ Source/WebCore/bindings/js/JSDOMIterator.h	(working copy)
>@@ -265,6 +265,8 @@ void JSDOMIteratorPrototype<JSWrapper, I
>     ASSERT(inherits(vm, info()));
> 
>     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->next, next, 0, 0, JSC::NoIntrinsic);
>+    auto className = jsString(&vm, methodTable(vm)->className(this, vm));
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, className, JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
>     didBecomePrototype();
> }
> 
>Index: Source/WebCore/bindings/js/JSDOMWindowProperties.cpp
>===================================================================
>--- Source/WebCore/bindings/js/JSDOMWindowProperties.cpp	(revision 246731)
>+++ Source/WebCore/bindings/js/JSDOMWindowProperties.cpp	(working copy)
>@@ -81,6 +81,13 @@ static bool jsDOMWindowPropertiesGetOwnP
>     return false;
> }
> 
>+void JSDOMWindowProperties::finishCreation(VM& vm)
>+{
>+    Base::finishCreation(vm);
>+    ASSERT(inherits(vm, info()));
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WindowProperties"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
>+}
>+
> bool JSDOMWindowProperties::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot& slot)
> {
>     auto* thisObject = jsCast<JSDOMWindowProperties*>(object);
>Index: Source/WebCore/bindings/js/JSDOMWindowProperties.h
>===================================================================
>--- Source/WebCore/bindings/js/JSDOMWindowProperties.h	(revision 246731)
>+++ Source/WebCore/bindings/js/JSDOMWindowProperties.h	(working copy)
>@@ -57,6 +57,8 @@ protected:
>     {
>         didBecomePrototype();
>     }
>+
>+    void finishCreation(VM&);
> };
> 
> } // namespace WebCore
>Index: Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
>===================================================================
>--- Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	(revision 246731)
>+++ Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	(working copy)
>@@ -4359,6 +4359,8 @@ sub GenerateImplementation
>         push(@implContent, "    putDirect(vm, vm.propertyNames->toPrimitiveSymbol, jsUndefined(), JSC::PropertyAttribute::DontDelete | JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);\n");
>     }
> 
>+    push(@implContent, "    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, \"${visibleInterfaceName}\"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);\n");
>+
>     if ($interface->mapLike) {
>         push(@implContent, "    synchronizeBackingMap(*globalObject()->globalExec(), *globalObject(), *this);\n");
>     }
>@@ -7063,6 +7065,8 @@ sub GeneratePrototypeDeclaration
> {
>     my ($outputArray, $className, $interface) = @_;
> 
>+    my $visibleInterfaceName = $codeGenerator->GetVisibleInterfaceName($interface);
>+    my $prototypeVisibleName = "${visibleInterfaceName}Prototype";
>     my $prototypeClassName = "${className}Prototype";
> 
>     my %structureFlags = ();
>@@ -7074,6 +7078,7 @@ sub GeneratePrototypeDeclaration
>     push(@$outputArray, "    {\n");
>     push(@$outputArray, "        ${className}Prototype* ptr = new (NotNull, JSC::allocateCell<${className}Prototype>(vm.heap)) ${className}Prototype(vm, globalObject, structure);\n");
>     push(@$outputArray, "        ptr->finishCreation(vm);\n");
>+    push(@$outputArray, "        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, \"${prototypeVisibleName}\"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);\n");
>     push(@$outputArray, "        return ptr;\n");
>     push(@$outputArray, "    }\n\n");
> 
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 246731)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.prototype.toString is not spec-perfect
>+        https://bugs.webkit.org/show_bug.cgi?id=199138
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * inspector/model/remote-object-get-properties-expected.txt:
>+        * platform/mac/inspector/model/remote-object-dom-expected.txt:
>+
> 2019-06-24  Antoine Quint  <graouts@apple.com>
> 
>         [Pointer Events] Respect pointer capture when dispatching mouse boundary events and updating :hover
>Index: LayoutTests/imported/w3c/ChangeLog
>===================================================================
>--- LayoutTests/imported/w3c/ChangeLog	(revision 246731)
>+++ LayoutTests/imported/w3c/ChangeLog	(working copy)
>@@ -1,3 +1,16 @@
>+2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.prototype.toString is not spec-perfect
>+        https://bugs.webkit.org/show_bug.cgi?id=199138
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Mark 3 test cases as passing.
>+
>+        * web-platform-tests/WebIDL/ecmascript-binding/default-iterator-object-expected.txt:
>+        * web-platform-tests/WebIDL/ecmascript-binding/interface-prototype-object-expected.txt:
>+        * web-platform-tests/WebIDL/ecmascript-binding/iterator-prototype-object-expected.txt:
>+
> 2019-06-24  Antoine Quint  <graouts@apple.com>
> 
>         [Pointer Events] Respect pointer capture when dispatching mouse boundary events and updating :hover
>Index: LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/default-iterator-object-expected.txt
>===================================================================
>--- LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/default-iterator-object-expected.txt	(revision 246731)
>+++ LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/default-iterator-object-expected.txt	(working copy)
>@@ -1,5 +1,5 @@
> 
> PASS Default iterator objects for an interface have the same prototype 
> PASS Object.prototype.toString returns correct value 
>-FAIL @@toStringTag has correct value from prototype assert_equals: expected (string) "URLSearchParams Iterator" but got (undefined) undefined
>+PASS @@toStringTag has correct value from prototype 
> 
>Index: LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/interface-prototype-object-expected.txt
>===================================================================
>--- LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/interface-prototype-object-expected.txt	(revision 246731)
>+++ LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/interface-prototype-object-expected.txt	(working copy)
>@@ -1,3 +1,3 @@
> 
>-FAIL The class string of an interface prototype object is the concatenation of the interface's identifier and the string 'Prototype'. assert_true: An interface prototype object should have toStringTag property. expected true got false
>+PASS The class string of an interface prototype object is the concatenation of the interface's identifier and the string 'Prototype'. 
> 
>Index: LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/iterator-prototype-object-expected.txt
>===================================================================
>--- LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/iterator-prototype-object-expected.txt	(revision 246731)
>+++ LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/iterator-prototype-object-expected.txt	(working copy)
>@@ -3,6 +3,6 @@ PASS Has %IteratorPrototype% as prototyp
> PASS next() exists and is writable, enumerable, and configurable 
> PASS next() throws TypeError when called on ineligible receiver 
> PASS Object.prototype.toString returns correct value 
>-FAIL @@toStringTag has correct value undefined is not an object (evaluating 'Object.getOwnPropertyDescriptor(iteratorProto, Symbol.toStringTag).value')
>+PASS @@toStringTag has correct value 
> PASS Is specific to an interface 
> 
>Index: LayoutTests/inspector/model/remote-object-get-properties-expected.txt
>===================================================================
>--- LayoutTests/inspector/model/remote-object-get-properties-expected.txt	(revision 246731)
>+++ LayoutTests/inspector/model/remote-object-get-properties-expected.txt	(working copy)
>@@ -235,10 +235,12 @@ description: Event
> 
> OWN PROPERTIES:
>     isTrusted
>+    Symbol(Symbol.toStringTag)
>     __proto__
> 
> DISPLAYABLE PROPERTIES:
>     isTrusted
>+    Symbol(Symbol.toStringTag)
>     type
>     target
>     currentTarget
>@@ -255,6 +257,7 @@ DISPLAYABLE PROPERTIES:
> 
> ALL PROPERTIES:
>     isTrusted
>+    Symbol(Symbol.toStringTag)
>     constructor
>     type
>     target
>@@ -520,6 +523,7 @@ ALL PROPERTIES:
>     item
>     namedItem
>     Symbol(Symbol.iterator)
>+    Symbol(Symbol.toStringTag)
>     toString
>     toLocaleString
>     valueOf
>Index: LayoutTests/platform/mac/inspector/model/remote-object-dom-expected.txt
>===================================================================
>--- LayoutTests/platform/mac/inspector/model/remote-object-dom-expected.txt	(revision 246731)
>+++ LayoutTests/platform/mac/inspector/model/remote-object-dom-expected.txt	(working copy)
>@@ -17,6 +17,11 @@ EXPRESSION: window.loadEvent
>         "_value": "true"
>       },
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "Event"
>+      },
>+      {
>         "_name": "type",
>         "_type": "string",
>         "_value": "load"
>@@ -32,11 +37,6 @@ EXPRESSION: window.loadEvent
>         "_type": "object",
>         "_subtype": "null",
>         "_value": "null"
>-      },
>-      {
>-        "_name": "eventPhase",
>-        "_type": "number",
>-        "_value": "0"
>       }
>     ],
>     "_entries": null
>@@ -58,6 +58,11 @@ EXPRESSION: document.body
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "HTMLBodyElement"
>+      },
>+      {
>         "_name": "aLink",
>         "_type": "string",
>         "_value": ""
>@@ -76,11 +81,6 @@ EXPRESSION: document.body
>         "_name": "link",
>         "_type": "string",
>         "_value": ""
>-      },
>-      {
>-        "_name": "text",
>-        "_type": "string",
>-        "_value": ""
>       }
>     ],
>     "_entries": null
>@@ -102,6 +102,11 @@ EXPRESSION: div = document.createElement
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "HTMLDivElement"
>+      },
>+      {
>         "_name": "align",
>         "_type": "string",
>         "_value": ""
>@@ -120,11 +125,6 @@ EXPRESSION: div = document.createElement
>         "_name": "translate",
>         "_type": "boolean",
>         "_value": "true"
>-      },
>-      {
>-        "_name": "dir",
>-        "_type": "string",
>-        "_value": ""
>       }
>     ],
>     "_entries": null
>@@ -146,6 +146,11 @@ EXPRESSION: span = document.createElemen
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "HTMLSpanElement"
>+      },
>+      {
>         "_name": "title",
>         "_type": "string",
>         "_value": ""
>@@ -164,11 +169,6 @@ EXPRESSION: span = document.createElemen
>         "_name": "dir",
>         "_type": "string",
>         "_value": ""
>-      },
>-      {
>-        "_name": "dataset",
>-        "_type": "object",
>-        "_value": "DOMStringMap"
>       }
>     ],
>     "_entries": null
>@@ -190,6 +190,11 @@ EXPRESSION: input = document.createEleme
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "HTMLInputElement"
>+      },
>+      {
>         "_name": "accept",
>         "_type": "string",
>         "_value": ""
>@@ -208,11 +213,6 @@ EXPRESSION: input = document.createEleme
>         "_name": "autofocus",
>         "_type": "boolean",
>         "_value": "false"
>-      },
>-      {
>-        "_name": "defaultChecked",
>-        "_type": "boolean",
>-        "_value": "false"
>       }
>     ],
>     "_entries": null
>@@ -234,6 +234,11 @@ EXPRESSION: text = document.createTextNo
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "Text"
>+      },
>+      {
>         "_name": "wholeText",
>         "_type": "string",
>         "_value": "text content"
>@@ -253,11 +258,6 @@ EXPRESSION: text = document.createTextNo
>         "_name": "data",
>         "_type": "string",
>         "_value": "text content"
>-      },
>-      {
>-        "_name": "length",
>-        "_type": "number",
>-        "_value": "12"
>       }
>     ],
>     "_entries": null
>@@ -279,6 +279,11 @@ EXPRESSION: comment = document.createCom
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "Comment"
>+      },
>+      {
>         "_name": "data",
>         "_type": "string",
>         "_value": "comment content"
>@@ -299,11 +304,6 @@ EXPRESSION: comment = document.createCom
>         "_type": "object",
>         "_subtype": "null",
>         "_value": "null"
>-      },
>-      {
>-        "_name": "substringData",
>-        "_type": "function",
>-        "_value": ""
>       }
>     ],
>     "_entries": null
>@@ -325,6 +325,11 @@ EXPRESSION: svgElement = document.create
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "SVGRectElement"
>+      },
>+      {
>         "_name": "x",
>         "_type": "object",
>         "_value": "SVGAnimatedLength"
>@@ -343,11 +348,6 @@ EXPRESSION: svgElement = document.create
>         "_name": "height",
>         "_type": "object",
>         "_value": "SVGAnimatedLength"
>-      },
>-      {
>-        "_name": "rx",
>-        "_type": "object",
>-        "_value": "SVGAnimatedLength"
>       }
>     ],
>     "_entries": null

Actions: View | Formatted Diff | Diff

Attachments on bug 199138: 372719 | 372722 | 372723 | 372725 | 372726 | 372748 | 372771 | 374400 | 374407 | 398257 | 398293 | 398436