Attachment 372771 Details for Bug 199138 – Patch

[patch] Patch

bug-199138-20190624204734.patch (text/plain), 122.64 KB, created by Alexey Shvayka on 2019-06-24 10:47:37 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Alexey Shvayka

Created: 2019-06-24 10:47:37 PDT

Size: 122.64 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 246738)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.prototype.toString is not spec-perfect
>+        https://bugs.webkit.org/show_bug.cgi?id=199138
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * test262/expectations.yaml: Mark 2 test cases as passing.
>+        * wasm/spec-tests/jsapi.js: Check @@toStringTag values.
>+
> 2019-06-22  Robin Morisset  <rmorisset@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         All prototypes should call didBecomePrototype()
>Index: JSTests/test262/expectations.yaml
>===================================================================
>--- JSTests/test262/expectations.yaml	(revision 246738)
>+++ JSTests/test262/expectations.yaml	(working copy)
>@@ -1089,9 +1089,6 @@ test/built-ins/Object/keys/property-trap
> test/built-ins/Object/proto-from-ctor.js:
>   default: 'Test262Error: Expected SameValue(ÃÂ«[object Object]ÃÂ», ÃÂ«[object Object]ÃÂ») to be true'
>   strict mode: 'Test262Error: Expected SameValue(ÃÂ«[object Object]ÃÂ», ÃÂ«[object Object]ÃÂ») to be true'
>-test/built-ins/Object/prototype/toString/proxy-function.js:
>-  default: 'Test262Error: function proxy Expected SameValue(ÃÂ«[object Object]ÃÂ», ÃÂ«[object Function]ÃÂ») to be true'
>-  strict mode: 'Test262Error: function proxy Expected SameValue(ÃÂ«[object Object]ÃÂ», ÃÂ«[object Function]ÃÂ») to be true'
> test/built-ins/Object/subclass-object-arg.js:
>   default: 'Test262Error: Expected SameValue(ÃÂ«undefinedÃÂ», ÃÂ«1ÃÂ») to be true'
>   strict mode: 'Test262Error: Expected SameValue(ÃÂ«undefinedÃÂ», ÃÂ«1ÃÂ») to be true'
>Index: JSTests/wasm/spec-tests/jsapi.js
>===================================================================
>--- JSTests/wasm/spec-tests/jsapi.js	(revision 246738)
>+++ JSTests/wasm/spec-tests/jsapi.js	(working copy)
>@@ -120,7 +120,7 @@ test(() => {
> test(() => {
>     const wasmDesc = Object.getOwnPropertyDescriptor(this, 'WebAssembly');
>     assert_equals(WebAssembly, wasmDesc.value);
>-    assert_equals(String(WebAssembly), "[object WebAssembly]");
>+    assert_equals(WebAssembly[Symbol.toStringTag], "WebAssembly");
> }, "'WebAssembly' object");
> 
> test(() => {
>@@ -212,7 +212,7 @@ test(() => {
>     const moduleProtoDesc = Object.getOwnPropertyDescriptor(Module, 'prototype');
>     const moduleProto = Module.prototype;
>     assert_equals(moduleProto, moduleProtoDesc.value);
>-    assert_equals(String(moduleProto), "[object WebAssembly.Module]");
>+    assert_equals(moduleProto[Symbol.toStringTag], "WebAssembly.Module");
>     assert_equals(Object.getPrototypeOf(moduleProto), Object.prototype);
> }, "'WebAssembly.Module.prototype' object");
> 
>@@ -351,7 +351,7 @@ test(() => {
>     instanceProto = Instance.prototype;
>     const instanceProtoDesc = Object.getOwnPropertyDescriptor(Instance, 'prototype');
>     assert_equals(instanceProto, instanceProtoDesc.value);
>-    assert_equals(String(instanceProto), "[object WebAssembly.Instance]");
>+    assert_equals(instanceProto[Symbol.toStringTag], "WebAssembly.Instance");
>     assert_equals(Object.getPrototypeOf(instanceProto), Object.prototype);
> }, "'WebAssembly.Instance.prototype' object");
> 
>@@ -436,7 +436,7 @@ test(() => {
>     memoryProto = Memory.prototype;
>     const memoryProtoDesc = Object.getOwnPropertyDescriptor(Memory, 'prototype');
>     assert_equals(memoryProto, memoryProtoDesc.value);
>-    assert_equals(String(memoryProto), "[object WebAssembly.Memory]");
>+    assert_equals(memoryProto[Symbol.toStringTag], "WebAssembly.Memory");
>     assert_equals(Object.getPrototypeOf(memoryProto), Object.prototype);
> }, "'WebAssembly.Memory.prototype' object");
> 
>@@ -538,7 +538,7 @@ test(() => {
>     const tableProtoDesc = Object.getOwnPropertyDescriptor(Table, 'prototype');
>     tableProto = Table.prototype;
>     assert_equals(tableProto, tableProtoDesc.value);
>-    assert_equals(String(tableProto), "[object WebAssembly.Table]");
>+    assert_equals(tableProto[Symbol.toStringTag], "WebAssembly.Table");
>     assert_equals(Object.getPrototypeOf(tableProto), Object.prototype);
> }, "'WebAssembly.Table.prototype' object");
> 
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 246738)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,90 @@
>+2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.prototype.toString is not spec-perfect
>+        https://bugs.webkit.org/show_bug.cgi?id=199138
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Before @@toStringTag was introduced, Object#toString relied solely on internal [[Class]] slot.
>+        Starting with ES6, newly introduced built-ins and DOM objects provide @@toStringTag for Object#toString to use.
>+        With @@toStringTag removed, Object#toString should not special-case them and return "[object Object]".
>+        Per current spec, Object#toString examines only a handful of internal slots for backwards compatibility.
>+
>+        Object#toString in JSC still relies on JSObject::className a.k.a. [[Class]] for all classes.
>+        For (almost all) new built-ins, it gets overriden by `toStringName` that returns "Object".
>+        This is quite error-prone approach and is observable spec discrepancy if @@toStringTag is deleted or set to non-string.
>+
>+        This change aligns both algorithm and results of Object#toString with the specification.
>+        (https://tc39.es/ecma262/#sec-object.prototype.tostring)
>+
>+        1. Changes JSObject::toStringName to return either "Function" or "Object" instead of `className`.
>+        2. Adds `toStringName` overrides to pre-ES6 classes: Boolean, Arguments, Date, Arguments, Error, Number, RegExp, and String.
>+        3. Adds `isArray` check to `objectProtoFuncToString` for Proxy detection.
>+        4. Adds @@toStringTag to WebAssembly constructors.
>+        5. Adds @@toStringTag to DOM constructors, prototypes, and iterators.
>+        6. Removes now useless "Object" overrides for BigInt, ArrayBuffer, Map, Set, WeakMap, WeakRef, and WeakSet.
>+        7. Removes now useless ProxyObject::toStringName.
>+
>+        * jsc.cpp:
>+        (GlobalObject::toStringName):
>+        * runtime/BigIntObject.cpp:
>+        (JSC::BigIntObject::toStringName): Deleted.
>+        * runtime/BigIntObject.h:
>+        * runtime/BooleanObject.h:
>+        (JSC::BooleanObject::toStringName):
>+        * runtime/ClonedArguments.h:
>+        * runtime/ConsoleObject.h:
>+        * runtime/DateInstance.h:
>+        * runtime/DirectArguments.h:
>+        * runtime/ErrorInstance.h:
>+        (JSC::ErrorInstance::toStringName):
>+        * runtime/JSArray.cpp:
>+        (JSC::JSArray::toStringName):
>+        * runtime/JSArray.h:
>+        * runtime/JSArrayBufferView.cpp:
>+        (JSC::JSArrayBufferView::toStringName): Deleted.
>+        * runtime/JSArrayBufferView.h:
>+        * runtime/JSMap.cpp:
>+        (JSC::JSMap::toStringName): Deleted.
>+        * runtime/JSMap.h:
>+        * runtime/JSObject.cpp:
>+        (JSC::JSObject::toStringName):
>+        * runtime/JSSet.cpp:
>+        (JSC::JSSet::toStringName): Deleted.
>+        * runtime/JSSet.h:
>+        * runtime/JSWeakMap.cpp:
>+        (JSC::JSWeakMap::toStringName): Deleted.
>+        * runtime/JSWeakMap.h:
>+        * runtime/JSWeakObjectRef.cpp:
>+        (JSC::JSWeakObjectRef::toStringName): Deleted.
>+        * runtime/JSWeakObjectRef.h:
>+        * runtime/JSWeakSet.cpp:
>+        (JSC::JSWeakSet::toStringName): Deleted.
>+        * runtime/JSWeakSet.h:
>+        * runtime/NumberObject.h:
>+        (JSC::NumberObject::toStringName):
>+        * runtime/ObjectPrototype.cpp:
>+        (JSC::objectProtoFuncToString):
>+        * runtime/ProxyObject.cpp:
>+        (JSC::ProxyObject::toStringName): Deleted.
>+        * runtime/ProxyObject.h:
>+        * runtime/RegExpObject.h:
>+        * runtime/StringObject.h:
>+        (JSC::StringObject::toStringName):
>+        * runtime/SymbolObject.cpp:
>+        (JSC::SymbolObject::toStringName): Deleted.
>+        * runtime/SymbolObject.h:
>+        * wasm/js/JSWebAssembly.cpp:
>+        (JSC::JSWebAssembly::finishCreation):
>+        * wasm/js/WebAssemblyInstancePrototype.cpp:
>+        (JSC::WebAssemblyInstancePrototype::finishCreation):
>+        * wasm/js/WebAssemblyMemoryPrototype.cpp:
>+        (JSC::WebAssemblyMemoryPrototype::finishCreation):
>+        * wasm/js/WebAssemblyModulePrototype.cpp:
>+        (JSC::WebAssemblyModulePrototype::finishCreation):
>+        * wasm/js/WebAssemblyTablePrototype.cpp:
>+        (JSC::WebAssemblyTablePrototype::finishCreation):
>+
> 2019-06-22  Robin Morisset  <rmorisset@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         All prototypes should call didBecomePrototype()
>Index: Source/JavaScriptCore/jsc.cpp
>===================================================================
>--- Source/JavaScriptCore/jsc.cpp	(revision 246738)
>+++ Source/JavaScriptCore/jsc.cpp	(working copy)
>@@ -493,6 +493,7 @@ public:
>         return Structure::create(vm, 0, prototype, TypeInfo(GlobalObjectType, StructureFlags), info());
>     }
> 
>+    static String toStringName(const JSObject*, ExecState*) { return "global"_s; }
>     static RuntimeFlags javaScriptRuntimeFlags(const JSGlobalObject*) { return RuntimeFlags::createAllEnabled(); }
> 
> protected:
>Index: Source/JavaScriptCore/runtime/BigIntObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/BigIntObject.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/BigIntObject.cpp	(working copy)
>@@ -56,11 +56,6 @@ void BigIntObject::finishCreation(VM& vm
>     setInternalValue(vm, bigInt);
> }
> 
>-String BigIntObject::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> JSValue BigIntObject::defaultValue(const JSObject* object, ExecState*, PreferredPrimitiveType)
> {
>     const BigIntObject* bigIntObject = jsCast<const BigIntObject*>(object);
>Index: Source/JavaScriptCore/runtime/BigIntObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/BigIntObject.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/BigIntObject.h	(working copy)
>@@ -48,8 +48,6 @@ public:
> 
>     static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
> 
>-    static String toStringName(const JSObject*, ExecState*);
>-
> protected:
>     JS_EXPORT_PRIVATE void finishCreation(VM&, JSBigInt*);
>     JS_EXPORT_PRIVATE BigIntObject(VM&, Structure*);
>Index: Source/JavaScriptCore/runtime/BooleanObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/BooleanObject.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/BooleanObject.h	(working copy)
>@@ -45,6 +45,8 @@ public:
>     {
>         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
>     }
>+
>+    static String toStringName(const JSObject*, ExecState*) { return "Boolean"_s; }
> };
> 
> } // namespace JSC
>Index: Source/JavaScriptCore/runtime/ClonedArguments.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ClonedArguments.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/ClonedArguments.h	(working copy)
>@@ -56,6 +56,7 @@ public:
>     static Structure* createSlowPutStructure(VM&, JSGlobalObject*, JSValue prototype);
> 
>     static void visitChildren(JSCell*, SlotVisitor&);
>+    static String toStringName(const JSObject*, ExecState*) { return "Arguments"_s; }
> 
>     DECLARE_INFO;
> 
>Index: Source/JavaScriptCore/runtime/ConsoleObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ConsoleObject.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/ConsoleObject.h	(working copy)
>@@ -50,6 +50,8 @@ public:
>         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
>     }
> 
>+    static String toStringName(const JSObject*, ExecState*) { return "Console"_s; }
>+
> protected:
>     void finishCreation(VM&, JSGlobalObject*);
> };
>Index: Source/JavaScriptCore/runtime/DateInstance.h
>===================================================================
>--- Source/JavaScriptCore/runtime/DateInstance.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/DateInstance.h	(working copy)
>@@ -73,6 +73,8 @@ public:
>         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
>     }
> 
>+    static String toStringName(const JSObject*, ExecState*) { return "Date"_s; }
>+
> private:
>     JS_EXPORT_PRIVATE const GregorianDateTime* calculateGregorianDateTime(ExecState*) const;
>     JS_EXPORT_PRIVATE const GregorianDateTime* calculateGregorianDateTimeUTC(ExecState*) const;
>Index: Source/JavaScriptCore/runtime/DirectArguments.h
>===================================================================
>--- Source/JavaScriptCore/runtime/DirectArguments.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/DirectArguments.h	(working copy)
>@@ -170,6 +170,8 @@ public:
>     {
>         return offsetOfSlot(capacity);
>     }
>+
>+    static String toStringName(const JSObject*, ExecState*) { return "Arguments"_s; }
>     
> private:
>     WriteBarrier<Unknown>* storage()
>Index: Source/JavaScriptCore/runtime/ErrorInstance.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ErrorInstance.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/ErrorInstance.h	(working copy)
>@@ -51,6 +51,7 @@ public:
>     }
> 
>     static ErrorInstance* create(ExecState*, Structure*, JSValue message, SourceAppender = nullptr, RuntimeType = TypeNothing, bool useCurrentFrame = true);
>+    static String toStringName(const JSObject*, ExecState*) { return "Error"_s; }
> 
>     bool hasSourceAppender() const { return !!m_sourceAppender; }
>     SourceAppender sourceAppender() const { return m_sourceAppender; }
>Index: Source/JavaScriptCore/runtime/JSArray.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArray.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSArray.cpp	(working copy)
>@@ -43,6 +43,7 @@ STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(
> 
> const ClassInfo JSArray::s_info = {"Array", &JSNonFinalObject::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSArray)};
> 
>+String JSArray::toStringName(const JSObject*, ExecState*) { return "Array"_s; }
> JSArray* JSArray::tryCreateUninitializedRestricted(ObjectInitializationScope& scope, GCDeferralContext* deferralContext, Structure* structure, unsigned initialLength)
> {
>     VM& vm = scope.vm();
>Index: Source/JavaScriptCore/runtime/JSArray.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArray.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSArray.h	(working copy)
>@@ -171,6 +171,8 @@ public:
>     {
>         return Structure::create(vm, globalObject, prototype, TypeInfo(ArrayType, StructureFlags), info(), indexingType);
>     }
>+
>+    JS_EXPORT_PRIVATE static String toStringName(const JSObject*, ExecState*);
>         
> protected:
>     void finishCreation(VM& vm)
>Index: Source/JavaScriptCore/runtime/JSArrayBufferView.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArrayBufferView.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSArrayBufferView.cpp	(working copy)
>@@ -42,11 +42,6 @@ const ClassInfo JSArrayBufferView::s_inf
>     "ArrayBufferView", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSArrayBufferView)
> };
> 
>-String JSArrayBufferView::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> JSArrayBufferView::ConstructionContext::ConstructionContext(
>     Structure* structure, uint32_t length, void* vector)
>     : m_structure(structure)
>Index: Source/JavaScriptCore/runtime/JSArrayBufferView.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArrayBufferView.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSArrayBufferView.h	(working copy)
>@@ -193,8 +193,6 @@ protected:
> 
>     ArrayBuffer* existingBufferInButterfly();
> 
>-    static String toStringName(const JSObject*, ExecState*);
>-
>     VectorPtr m_vector;
>     uint32_t m_length;
>     TypedArrayMode m_mode;
>Index: Source/JavaScriptCore/runtime/JSMap.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSMap.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSMap.cpp	(working copy)
>@@ -33,11 +33,6 @@ namespace JSC {
> 
> const ClassInfo JSMap::s_info = { "Map", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSMap) };
> 
>-String JSMap::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> JSMap* JSMap::clone(ExecState* exec, VM& vm, Structure* structure)
> {
>     JSMap* instance = new (NotNull, allocateCell<JSMap>(vm.heap)) JSMap(vm, structure);
>Index: Source/JavaScriptCore/runtime/JSMap.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSMap.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSMap.h	(working copy)
>@@ -62,8 +62,6 @@ private:
>         : Base(vm, structure)
>     {
>     }
>-
>-    static String toStringName(const JSObject*, ExecState*);
> };
> 
> static_assert(std::is_final<JSMap>::value, "Required for JSType based casting");
>Index: Source/JavaScriptCore/runtime/JSObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSObject.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSObject.cpp	(working copy)
>@@ -518,10 +518,7 @@ String JSObject::className(const JSObjec
> 
> String JSObject::toStringName(const JSObject* object, ExecState* exec)
> {
>-    VM& vm = exec->vm();
>-    const ClassInfo* info = object->classInfo(vm);
>-    ASSERT(info);
>-    return info->className;
>+    return const_cast<JSObject*>(object)->isFunction(exec->vm()) ? "Function"_s : "Object"_s;
> }
> 
> String JSObject::calculatedClassName(JSObject* object)
>Index: Source/JavaScriptCore/runtime/JSSet.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSSet.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSSet.cpp	(working copy)
>@@ -33,11 +33,6 @@ namespace JSC {
> 
> const ClassInfo JSSet::s_info = { "Set", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSSet) };
> 
>-String JSSet::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> JSSet* JSSet::clone(ExecState* exec, VM& vm, Structure* structure)
> {
>     JSSet* instance = new (NotNull, allocateCell<JSSet>(vm.heap)) JSSet(vm, structure);
>Index: Source/JavaScriptCore/runtime/JSSet.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSSet.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSSet.h	(working copy)
>@@ -67,8 +67,6 @@ private:
>         : Base(vm, structure, sizeHint)
>     {
>     }
>-
>-    static String toStringName(const JSObject*, ExecState*);
> };
> 
> static_assert(std::is_final<JSSet>::value, "Required for JSType based casting");
>Index: Source/JavaScriptCore/runtime/JSWeakMap.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakMap.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSWeakMap.cpp	(working copy)
>@@ -32,9 +32,4 @@ namespace JSC {
> 
> const ClassInfo JSWeakMap::s_info = { "WeakMap", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSWeakMap) };
> 
>-String JSWeakMap::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> }
>Index: Source/JavaScriptCore/runtime/JSWeakMap.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakMap.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSWeakMap.h	(working copy)
>@@ -58,8 +58,6 @@ private:
>         : Base(vm, structure)
>     {
>     }
>-
>-    static String toStringName(const JSObject*, ExecState*);
> };
> 
> static_assert(std::is_final<JSWeakMap>::value, "Required for JSType based casting");
>Index: Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp	(working copy)
>@@ -57,10 +57,5 @@ void JSWeakObjectRef::finalizeUnconditio
>         m_value.clear();
> }
> 
>-String JSWeakObjectRef::toStringName(const JSC::JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> }
> 
>Index: Source/JavaScriptCore/runtime/JSWeakObjectRef.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakObjectRef.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSWeakObjectRef.h	(working copy)
>@@ -75,8 +75,6 @@ private:
> 
>     JS_EXPORT_PRIVATE void finishCreation(VM&, JSObject* value);
> 
>-    static String toStringName(const JSObject*, ExecState*);
>-
>     uintptr_t m_lastAccessVersion;
>     WriteBarrier<JSObject> m_value;
> };
>Index: Source/JavaScriptCore/runtime/JSWeakSet.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakSet.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSWeakSet.cpp	(working copy)
>@@ -32,9 +32,4 @@ namespace JSC {
> 
> const ClassInfo JSWeakSet::s_info = { "WeakSet", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSWeakSet) };
> 
>-String JSWeakSet::toStringName(const JSC::JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> }
>Index: Source/JavaScriptCore/runtime/JSWeakSet.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSWeakSet.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/JSWeakSet.h	(working copy)
>@@ -53,8 +53,6 @@ private:
>         : Base(vm, structure)
>     {
>     }
>-
>-    static String toStringName(const JSObject*, ExecState*);
> };
> 
> static_assert(std::is_final<JSWeakSet>::value, "Required for JSType based casting");
>Index: Source/JavaScriptCore/runtime/NumberObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/NumberObject.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/NumberObject.h	(working copy)
>@@ -45,6 +45,8 @@ public:
>     {
>         return Structure::create(vm, globalObject, prototype, TypeInfo(NumberObjectType, StructureFlags), info());
>     }
>+
>+    static String toStringName(const JSObject*, ExecState*) { return "Number"_s; }
> };
> 
> JS_EXPORT_PRIVATE NumberObject* constructNumber(ExecState*, JSGlobalObject*, JSValue);
>Index: Source/JavaScriptCore/runtime/ObjectPrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/ObjectPrototype.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/ObjectPrototype.cpp	(working copy)
>@@ -21,6 +21,7 @@
> #include "config.h"
> #include "ObjectPrototype.h"
> 
>+#include "ArrayConstructor.h"
> #include "Error.h"
> #include "GetterSetter.h"
> #include "HasOwnPropertyCache.h"
>@@ -339,7 +340,9 @@ EncodedJSValue JSC_HOST_CALL objectProto
>             }
>         }
> 
>-        String tag = thisObject->methodTable(vm)->toStringName(thisObject, exec);
>+        bool thisIsArray = isArray(exec, thisObject);
>+        RETURN_IF_EXCEPTION(scope, { });
>+        String tag = thisIsArray ? "Array"_s : thisObject->methodTable(vm)->toStringName(thisObject, exec);
>         RETURN_IF_EXCEPTION(scope, { });
>         String newString = tryMakeString("[object ", WTFMove(tag), "]");
>         if (!newString)
>Index: Source/JavaScriptCore/runtime/ProxyObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/ProxyObject.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/ProxyObject.cpp	(working copy)
>@@ -26,7 +26,6 @@
> #include "config.h"
> #include "ProxyObject.h"
> 
>-#include "ArrayConstructor.h"
> #include "Error.h"
> #include "IdentifierInlines.h"
> #include "JSCInlines.h"
>@@ -51,24 +50,6 @@ ProxyObject::ProxyObject(VM& vm, Structu
> {
> }
> 
>-String ProxyObject::toStringName(const JSObject* object, ExecState* exec)
>-{
>-    VM& vm = exec->vm();
>-    auto scope = DECLARE_THROW_SCOPE(vm);
>-    const ProxyObject* proxy = jsCast<const ProxyObject*>(object);
>-    while (proxy) {
>-        const JSObject* target = proxy->target();
>-        bool targetIsArray = isArray(exec, target);
>-        if (UNLIKELY(scope.exception()))
>-            break;
>-        if (targetIsArray)
>-            RELEASE_AND_RETURN(scope, target->classInfo(vm)->methodTable.toStringName(target, exec));
>-
>-        proxy = jsDynamicCast<const ProxyObject*>(vm, target);
>-    }
>-    return "Object"_s;
>-}
>-
> Structure* ProxyObject::structureForTarget(JSGlobalObject* globalObject, JSValue target)
> {
>     if (!target.isObject())
>Index: Source/JavaScriptCore/runtime/ProxyObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ProxyObject.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/ProxyObject.h	(working copy)
>@@ -74,7 +74,6 @@ private:
>     JS_EXPORT_PRIVATE void finishCreation(VM&, ExecState*, JSValue target, JSValue handler);
>     JS_EXPORT_PRIVATE static Structure* structureForTarget(JSGlobalObject*, JSValue target);
> 
>-    static String toStringName(const JSObject*, ExecState*);
>     static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
>     static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&);
>     static CallType getCallData(JSCell*, CallData&);
>Index: Source/JavaScriptCore/runtime/RegExpObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/RegExpObject.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/RegExpObject.h	(working copy)
>@@ -48,6 +48,8 @@ public:
>         return object;
>     }
> 
>+    static String toStringName(const JSObject*, ExecState*) { return "RegExp"_s; }
>+
>     void setRegExp(VM& vm, RegExp* regExp)
>     {
>         uintptr_t result = (m_regExpAndLastIndexIsNotWritableFlag & lastIndexIsNotWritableFlag) | bitwise_cast<uintptr_t>(regExp);
>Index: Source/JavaScriptCore/runtime/StringObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/StringObject.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/StringObject.h	(working copy)
>@@ -66,6 +66,8 @@ public:
>         return Structure::create(vm, globalObject, prototype, TypeInfo(StringObjectType, StructureFlags), info());
>     }
> 
>+    static String toStringName(const JSObject*, ExecState*) { return "String"_s; }
>+
> protected:
>     JS_EXPORT_PRIVATE void finishCreation(VM&, JSString*);
>     JS_EXPORT_PRIVATE StringObject(VM&, Structure*);
>Index: Source/JavaScriptCore/runtime/SymbolObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/SymbolObject.cpp	(revision 246738)
>+++ Source/JavaScriptCore/runtime/SymbolObject.cpp	(working copy)
>@@ -47,11 +47,6 @@ void SymbolObject::finishCreation(VM& vm
>     setInternalValue(vm, symbol);
> }
> 
>-String SymbolObject::toStringName(const JSObject*, ExecState*)
>-{
>-    return "Object"_s;
>-}
>-
> JSValue SymbolObject::defaultValue(const JSObject* object, ExecState*, PreferredPrimitiveType)
> {
>     const SymbolObject* symbolObject = jsCast<const SymbolObject*>(object);
>Index: Source/JavaScriptCore/runtime/SymbolObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/SymbolObject.h	(revision 246738)
>+++ Source/JavaScriptCore/runtime/SymbolObject.h	(working copy)
>@@ -56,8 +56,6 @@ public:
> 
>     static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
> 
>-    static String toStringName(const JSObject*, ExecState*);
>-
> protected:
>     JS_EXPORT_PRIVATE void finishCreation(VM&, Symbol*);
>     JS_EXPORT_PRIVATE SymbolObject(VM&, Structure*);
>Index: Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp
>===================================================================
>--- Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp	(revision 246738)
>+++ Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp	(working copy)
>@@ -82,6 +82,7 @@ void JSWebAssembly::finishCreation(VM& v
> {
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WebAssembly"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
> }
> 
> JSWebAssembly::JSWebAssembly(VM& vm, Structure* structure)
>Index: Source/JavaScriptCore/wasm/js/WebAssemblyInstancePrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/wasm/js/WebAssemblyInstancePrototype.cpp	(revision 246738)
>+++ Source/JavaScriptCore/wasm/js/WebAssemblyInstancePrototype.cpp	(working copy)
>@@ -87,6 +87,7 @@ void WebAssemblyInstancePrototype::finis
> {
>     Base::finishCreation(vm);
>     didBecomePrototype();
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WebAssembly.Instance"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
> }
> 
> WebAssemblyInstancePrototype::WebAssemblyInstancePrototype(VM& vm, Structure* structure)
>Index: Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp	(revision 246738)
>+++ Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp	(working copy)
>@@ -110,6 +110,7 @@ void WebAssemblyMemoryPrototype::finishC
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
>     didBecomePrototype();
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WebAssembly.Memory"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
> }
> 
> WebAssemblyMemoryPrototype::WebAssemblyMemoryPrototype(VM& vm, Structure* structure)
>Index: Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.cpp	(revision 246738)
>+++ Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.cpp	(working copy)
>@@ -57,6 +57,7 @@ void WebAssemblyModulePrototype::finishC
> {
>     Base::finishCreation(vm);
>     didBecomePrototype();
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WebAssembly.Module"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
> }
> 
> WebAssemblyModulePrototype::WebAssemblyModulePrototype(VM& vm, Structure* structure)
>Index: Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp	(revision 246738)
>+++ Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp	(working copy)
>@@ -167,6 +167,7 @@ void WebAssemblyTablePrototype::finishCr
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
>     didBecomePrototype();
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WebAssembly.Table"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
> }
> 
> WebAssemblyTablePrototype::WebAssemblyTablePrototype(VM& vm, Structure* structure)
>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 246738)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,21 @@
>+2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.prototype.toString is not spec-perfect
>+        https://bugs.webkit.org/show_bug.cgi?id=199138
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Adds @@toStringTag to DOM constructors, prototypes, and iterators.
>+
>+        * bindings/js/JSDOMIterator.h:
>+        (WebCore::IteratorTraits>::finishCreation):
>+        * bindings/js/JSDOMWindowProperties.cpp:
>+        (WebCore::JSDOMWindowProperties::finishCreation):
>+        * bindings/js/JSDOMWindowProperties.h:
>+        * bindings/scripts/CodeGeneratorJS.pm:
>+        (GenerateImplementation):
>+        (GeneratePrototypeDeclaration):
>+
> 2019-06-24  Greg Doolittle  <gr3g@apple.com>
> 
>         Web Inspector: AXI: Audit: image label test is throwing spurious errors on elements with existing alt attr, but no value: <img alt>
>Index: Source/WebCore/bindings/js/JSDOMIterator.h
>===================================================================
>--- Source/WebCore/bindings/js/JSDOMIterator.h	(revision 246738)
>+++ Source/WebCore/bindings/js/JSDOMIterator.h	(working copy)
>@@ -265,6 +265,8 @@ void JSDOMIteratorPrototype<JSWrapper, I
>     ASSERT(inherits(vm, info()));
> 
>     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->next, next, 0, 0, JSC::NoIntrinsic);
>+    auto className = jsString(&vm, methodTable(vm)->className(this, vm));
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, className, JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
>     didBecomePrototype();
> }
> 
>Index: Source/WebCore/bindings/js/JSDOMWindowProperties.cpp
>===================================================================
>--- Source/WebCore/bindings/js/JSDOMWindowProperties.cpp	(revision 246738)
>+++ Source/WebCore/bindings/js/JSDOMWindowProperties.cpp	(working copy)
>@@ -81,6 +81,13 @@ static bool jsDOMWindowPropertiesGetOwnP
>     return false;
> }
> 
>+void JSDOMWindowProperties::finishCreation(VM& vm)
>+{
>+    Base::finishCreation(vm);
>+    ASSERT(inherits(vm, info()));
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WindowProperties"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
>+}
>+
> bool JSDOMWindowProperties::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot& slot)
> {
>     auto* thisObject = jsCast<JSDOMWindowProperties*>(object);
>Index: Source/WebCore/bindings/js/JSDOMWindowProperties.h
>===================================================================
>--- Source/WebCore/bindings/js/JSDOMWindowProperties.h	(revision 246738)
>+++ Source/WebCore/bindings/js/JSDOMWindowProperties.h	(working copy)
>@@ -57,6 +57,8 @@ protected:
>     {
>         didBecomePrototype();
>     }
>+
>+    void finishCreation(VM&);
> };
> 
> } // namespace WebCore
>Index: Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
>===================================================================
>--- Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	(revision 246738)
>+++ Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	(working copy)
>@@ -4359,6 +4359,8 @@ sub GenerateImplementation
>         push(@implContent, "    putDirect(vm, vm.propertyNames->toPrimitiveSymbol, jsUndefined(), JSC::PropertyAttribute::DontDelete | JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);\n");
>     }
> 
>+    push(@implContent, "    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, \"${visibleInterfaceName}\"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);\n");
>+
>     if ($interface->mapLike) {
>         push(@implContent, "    synchronizeBackingMap(*globalObject()->globalExec(), *globalObject(), *this);\n");
>     }
>@@ -7063,6 +7065,8 @@ sub GeneratePrototypeDeclaration
> {
>     my ($outputArray, $className, $interface) = @_;
> 
>+    my $visibleInterfaceName = $codeGenerator->GetVisibleInterfaceName($interface);
>+    my $prototypeVisibleName = "${visibleInterfaceName}Prototype";
>     my $prototypeClassName = "${className}Prototype";
> 
>     my %structureFlags = ();
>@@ -7074,6 +7078,7 @@ sub GeneratePrototypeDeclaration
>     push(@$outputArray, "    {\n");
>     push(@$outputArray, "        ${className}Prototype* ptr = new (NotNull, JSC::allocateCell<${className}Prototype>(vm.heap)) ${className}Prototype(vm, globalObject, structure);\n");
>     push(@$outputArray, "        ptr->finishCreation(vm);\n");
>+    push(@$outputArray, "        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, \"${prototypeVisibleName}\"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);\n");
>     push(@$outputArray, "        return ptr;\n");
>     push(@$outputArray, "    }\n\n");
> 
>Index: Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp	(working copy)
>@@ -49,6 +49,7 @@ public:
>     {
>         JSInterfaceNamePrototype* ptr = new (NotNull, JSC::allocateCell<JSInterfaceNamePrototype>(vm.heap)) JSInterfaceNamePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "InterfaceNamePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -112,6 +113,7 @@ void JSInterfaceName::finishCreation(VM&
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "InterfaceName"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSInterfaceName::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSMapLike.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSMapLike.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSMapLike.cpp	(working copy)
>@@ -68,6 +68,7 @@ public:
>     {
>         JSMapLikePrototype* ptr = new (NotNull, JSC::allocateCell<JSMapLikePrototype>(vm.heap)) JSMapLikePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "MapLikePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -142,6 +143,7 @@ void JSMapLike::finishCreation(VM& vm)
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "MapLike"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
>     synchronizeBackingMap(*globalObject()->globalExec(), *globalObject(), *this);
> }
> 
>Index: Source/WebCore/bindings/scripts/test/JS/JSReadOnlyMapLike.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSReadOnlyMapLike.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSReadOnlyMapLike.cpp	(working copy)
>@@ -65,6 +65,7 @@ public:
>     {
>         JSReadOnlyMapLikePrototype* ptr = new (NotNull, JSC::allocateCell<JSReadOnlyMapLikePrototype>(vm.heap)) JSReadOnlyMapLikePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "ReadOnlyMapLikePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -136,6 +137,7 @@ void JSReadOnlyMapLike::finishCreation(V
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "ReadOnlyMapLike"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
>     synchronizeBackingMap(*globalObject()->globalExec(), *globalObject(), *this);
> }
> 
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp	(working copy)
>@@ -62,6 +62,7 @@ public:
>     {
>         JSTestActiveDOMObjectPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestActiveDOMObjectPrototype>(vm.heap)) JSTestActiveDOMObjectPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestActiveDOMObjectPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -141,6 +142,7 @@ void JSTestActiveDOMObject::finishCreati
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestActiveDOMObject"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestActiveDOMObject::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp	(working copy)
>@@ -74,6 +74,7 @@ public:
>     {
>         JSTestCEReactionsPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestCEReactionsPrototype>(vm.heap)) JSTestCEReactionsPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestCEReactionsPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -145,6 +146,7 @@ void JSTestCEReactions::finishCreation(V
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestCEReactions"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestCEReactions::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp	(working copy)
>@@ -61,6 +61,7 @@ public:
>     {
>         JSTestCEReactionsStringifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestCEReactionsStringifierPrototype>(vm.heap)) JSTestCEReactionsStringifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestCEReactionsStringifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -127,6 +128,7 @@ void JSTestCEReactionsStringifier::finis
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestCEReactionsStringifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestCEReactionsStringifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp	(working copy)
>@@ -79,6 +79,7 @@ public:
>     {
>         JSTestCallTracerPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestCallTracerPrototype>(vm.heap)) JSTestCallTracerPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestCallTracerPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -165,6 +166,7 @@ void JSTestCallTracer::finishCreation(VM
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestCallTracer"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestCallTracer::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp	(working copy)
>@@ -50,6 +50,7 @@ public:
>     {
>         JSTestClassWithJSBuiltinConstructorPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestClassWithJSBuiltinConstructorPrototype>(vm.heap)) JSTestClassWithJSBuiltinConstructorPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestClassWithJSBuiltinConstructorPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -118,6 +119,7 @@ void JSTestClassWithJSBuiltinConstructor
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestClassWithJSBuiltinConstructor"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestClassWithJSBuiltinConstructor::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp	(working copy)
>@@ -472,6 +472,7 @@ public:
>     {
>         JSTestDOMJITPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestDOMJITPrototype>(vm.heap)) JSTestDOMJITPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestDOMJITPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -576,6 +577,7 @@ void JSTestDOMJIT::finishCreation(VM& vm
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestDOMJIT"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestDOMJIT::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestEnabledBySetting.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestEnabledBySetting.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestEnabledBySetting.cpp	(working copy)
>@@ -71,6 +71,7 @@ public:
>     {
>         JSTestEnabledBySettingPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestEnabledBySettingPrototype>(vm.heap)) JSTestEnabledBySettingPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestEnabledBySettingPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -163,6 +164,7 @@ void JSTestEnabledBySetting::finishCreat
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestEnabledBySetting"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
>     if (downcast<Document>(jsCast<JSDOMGlobalObject*>(globalObject())->scriptExecutionContext())->settings().testSettingEnabled())
>         putDirectCustomAccessor(vm, static_cast<JSVMClientData*>(vm.clientData)->builtinNames().TestSubObjEnabledBySettingPublicName(), CustomGetterSetter::create(vm, jsTestEnabledBySettingTestSubObjEnabledBySettingConstructor, setJSTestEnabledBySettingTestSubObjEnabledBySettingConstructor), attributesForStructure(static_cast<unsigned>(JSC::PropertyAttribute::DontEnum)));
> }
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp	(working copy)
>@@ -56,6 +56,7 @@ public:
>     {
>         JSTestEnabledForContextPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestEnabledForContextPrototype>(vm.heap)) JSTestEnabledForContextPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestEnabledForContextPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -119,6 +120,7 @@ void JSTestEnabledForContext::finishCrea
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestEnabledForContext"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
>     if ((downcast<Document>(jsCast<JSDOMGlobalObject*>(globalObject())->scriptExecutionContext())->settings().testSettingEnabled() && TestSubObjEnabledForContext::enabledForContext(*jsCast<JSDOMGlobalObject*>(globalObject())->scriptExecutionContext())))
>         putDirectCustomAccessor(vm, static_cast<JSVMClientData*>(vm.clientData)->builtinNames().TestSubObjEnabledForContextPublicName(), CustomGetterSetter::create(vm, jsTestEnabledForContextTestSubObjEnabledForContextConstructor, setJSTestEnabledForContextTestSubObjEnabledForContextConstructor), attributesForStructure(static_cast<unsigned>(JSC::PropertyAttribute::DontEnum)));
> }
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp	(working copy)
>@@ -131,6 +131,7 @@ public:
>     {
>         JSTestEventConstructorPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestEventConstructorPrototype>(vm.heap)) JSTestEventConstructorPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestEventConstructorPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -219,6 +220,7 @@ void JSTestEventConstructor::finishCreat
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestEventConstructor"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestEventConstructor::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp	(working copy)
>@@ -59,6 +59,7 @@ public:
>     {
>         JSTestEventTargetPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestEventTargetPrototype>(vm.heap)) JSTestEventTargetPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestEventTargetPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -124,6 +125,7 @@ void JSTestEventTarget::finishCreation(V
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestEventTarget"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestEventTarget::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp	(working copy)
>@@ -52,6 +52,7 @@ public:
>     {
>         JSTestExceptionPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestExceptionPrototype>(vm.heap)) JSTestExceptionPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestExceptionPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -116,6 +117,7 @@ void JSTestException::finishCreation(VM&
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestException"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestException::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp	(working copy)
>@@ -52,6 +52,7 @@ public:
>     {
>         JSTestGenerateIsReachablePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestGenerateIsReachablePrototype>(vm.heap)) JSTestGenerateIsReachablePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestGenerateIsReachablePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -125,6 +126,7 @@ void JSTestGenerateIsReachable::finishCr
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestGenerateIsReachable"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestGenerateIsReachable::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp	(working copy)
>@@ -701,6 +701,7 @@ void JSTestGlobalObject::finishCreation(
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestGlobalObject"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> #if ENABLE(TEST_FEATURE)
>     if (RuntimeEnabledFeatures::sharedFeatures().testFeatureEnabled())
>         putDirectCustomAccessor(vm, static_cast<JSVMClientData*>(vm.clientData)->builtinNames().enabledAtRuntimeAttributePublicName(), CustomGetterSetter::create(vm, jsTestGlobalObjectEnabledAtRuntimeAttribute, setJSTestGlobalObjectEnabledAtRuntimeAttribute), attributesForStructure(static_cast<unsigned>(JSC::PropertyAttribute::CustomAccessor)));
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h	(working copy)
>@@ -89,6 +89,7 @@ public:
>     {
>         JSTestGlobalObjectPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestGlobalObjectPrototype>(vm.heap)) JSTestGlobalObjectPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestGlobalObjectPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp	(working copy)
>@@ -51,6 +51,7 @@ public:
>     {
>         JSTestIndexedSetterNoIdentifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestIndexedSetterNoIdentifierPrototype>(vm.heap)) JSTestIndexedSetterNoIdentifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestIndexedSetterNoIdentifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -114,6 +115,7 @@ void JSTestIndexedSetterNoIdentifier::fi
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestIndexedSetterNoIdentifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestIndexedSetterNoIdentifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp	(working copy)
>@@ -51,6 +51,7 @@ public:
>     {
>         JSTestIndexedSetterThrowingExceptionPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestIndexedSetterThrowingExceptionPrototype>(vm.heap)) JSTestIndexedSetterThrowingExceptionPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestIndexedSetterThrowingExceptionPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -114,6 +115,7 @@ void JSTestIndexedSetterThrowingExceptio
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestIndexedSetterThrowingException"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestIndexedSetterThrowingException::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp	(working copy)
>@@ -57,6 +57,7 @@ public:
>     {
>         JSTestIndexedSetterWithIdentifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestIndexedSetterWithIdentifierPrototype>(vm.heap)) JSTestIndexedSetterWithIdentifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestIndexedSetterWithIdentifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -121,6 +122,7 @@ void JSTestIndexedSetterWithIdentifier::
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestIndexedSetterWithIdentifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestIndexedSetterWithIdentifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp	(working copy)
>@@ -155,6 +155,7 @@ public:
>     {
>         JSTestInterfacePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestInterfacePrototype>(vm.heap)) JSTestInterfacePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestInterfacePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -418,6 +419,7 @@ void JSTestInterface::finishCreation(VM&
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestInterface"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestInterface::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp	(working copy)
>@@ -52,6 +52,7 @@ public:
>     {
>         JSTestInterfaceLeadingUnderscorePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestInterfaceLeadingUnderscorePrototype>(vm.heap)) JSTestInterfaceLeadingUnderscorePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestInterfaceLeadingUnderscorePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -116,6 +117,7 @@ void JSTestInterfaceLeadingUnderscore::f
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestInterfaceLeadingUnderscore"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestInterfaceLeadingUnderscore::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp	(working copy)
>@@ -60,6 +60,7 @@ public:
>     {
>         JSTestIterablePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestIterablePrototype>(vm.heap)) JSTestIterablePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestIterablePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -128,6 +129,7 @@ void JSTestIterable::finishCreation(VM& 
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestIterable"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestIterable::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp	(working copy)
>@@ -56,6 +56,7 @@ public:
>     {
>         JSTestJSBuiltinConstructorPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestJSBuiltinConstructorPrototype>(vm.heap)) JSTestJSBuiltinConstructorPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestJSBuiltinConstructorPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -127,6 +128,7 @@ void JSTestJSBuiltinConstructor::finishC
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestJSBuiltinConstructor"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestJSBuiltinConstructor::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp	(working copy)
>@@ -57,6 +57,7 @@ public:
>     {
>         JSTestMediaQueryListListenerPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestMediaQueryListListenerPrototype>(vm.heap)) JSTestMediaQueryListListenerPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestMediaQueryListListenerPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -121,6 +122,7 @@ void JSTestMediaQueryListListener::finis
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestMediaQueryListListener"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestMediaQueryListListener::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp	(working copy)
>@@ -52,6 +52,7 @@ public:
>     {
>         JSTestNamedAndIndexedSetterNoIdentifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedAndIndexedSetterNoIdentifierPrototype>(vm.heap)) JSTestNamedAndIndexedSetterNoIdentifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedAndIndexedSetterNoIdentifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -115,6 +116,7 @@ void JSTestNamedAndIndexedSetterNoIdenti
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedAndIndexedSetterNoIdentifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedAndIndexedSetterNoIdentifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp	(working copy)
>@@ -52,6 +52,7 @@ public:
>     {
>         JSTestNamedAndIndexedSetterThrowingExceptionPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedAndIndexedSetterThrowingExceptionPrototype>(vm.heap)) JSTestNamedAndIndexedSetterThrowingExceptionPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedAndIndexedSetterThrowingExceptionPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -115,6 +116,7 @@ void JSTestNamedAndIndexedSetterThrowing
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedAndIndexedSetterThrowingException"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedAndIndexedSetterThrowingException::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp	(working copy)
>@@ -59,6 +59,7 @@ public:
>     {
>         JSTestNamedAndIndexedSetterWithIdentifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedAndIndexedSetterWithIdentifierPrototype>(vm.heap)) JSTestNamedAndIndexedSetterWithIdentifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedAndIndexedSetterWithIdentifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -124,6 +125,7 @@ void JSTestNamedAndIndexedSetterWithIden
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedAndIndexedSetterWithIdentifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedAndIndexedSetterWithIdentifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp	(working copy)
>@@ -52,6 +52,7 @@ public:
>     {
>         JSTestNamedConstructorPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedConstructorPrototype>(vm.heap)) JSTestNamedConstructorPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedConstructorPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -150,6 +151,7 @@ void JSTestNamedConstructor::finishCreat
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedConstructor"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedConstructor::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp	(working copy)
>@@ -51,6 +51,7 @@ public:
>     {
>         JSTestNamedDeleterNoIdentifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedDeleterNoIdentifierPrototype>(vm.heap)) JSTestNamedDeleterNoIdentifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedDeleterNoIdentifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -114,6 +115,7 @@ void JSTestNamedDeleterNoIdentifier::fin
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedDeleterNoIdentifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedDeleterNoIdentifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp	(working copy)
>@@ -51,6 +51,7 @@ public:
>     {
>         JSTestNamedDeleterThrowingExceptionPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedDeleterThrowingExceptionPrototype>(vm.heap)) JSTestNamedDeleterThrowingExceptionPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedDeleterThrowingExceptionPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -114,6 +115,7 @@ void JSTestNamedDeleterThrowingException
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedDeleterThrowingException"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedDeleterThrowingException::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp	(working copy)
>@@ -56,6 +56,7 @@ public:
>     {
>         JSTestNamedDeleterWithIdentifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedDeleterWithIdentifierPrototype>(vm.heap)) JSTestNamedDeleterWithIdentifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedDeleterWithIdentifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -120,6 +121,7 @@ void JSTestNamedDeleterWithIdentifier::f
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedDeleterWithIdentifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedDeleterWithIdentifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp	(working copy)
>@@ -52,6 +52,7 @@ public:
>     {
>         JSTestNamedDeleterWithIndexedGetterPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedDeleterWithIndexedGetterPrototype>(vm.heap)) JSTestNamedDeleterWithIndexedGetterPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedDeleterWithIndexedGetterPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -115,6 +116,7 @@ void JSTestNamedDeleterWithIndexedGetter
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedDeleterWithIndexedGetter"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedDeleterWithIndexedGetter::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp	(working copy)
>@@ -51,6 +51,7 @@ public:
>     {
>         JSTestNamedGetterCallWithPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedGetterCallWithPrototype>(vm.heap)) JSTestNamedGetterCallWithPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedGetterCallWithPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -114,6 +115,7 @@ void JSTestNamedGetterCallWith::finishCr
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedGetterCallWith"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedGetterCallWith::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp	(working copy)
>@@ -51,6 +51,7 @@ public:
>     {
>         JSTestNamedGetterNoIdentifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedGetterNoIdentifierPrototype>(vm.heap)) JSTestNamedGetterNoIdentifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedGetterNoIdentifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -114,6 +115,7 @@ void JSTestNamedGetterNoIdentifier::fini
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedGetterNoIdentifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedGetterNoIdentifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp	(working copy)
>@@ -56,6 +56,7 @@ public:
>     {
>         JSTestNamedGetterWithIdentifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedGetterWithIdentifierPrototype>(vm.heap)) JSTestNamedGetterWithIdentifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedGetterWithIdentifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -120,6 +121,7 @@ void JSTestNamedGetterWithIdentifier::fi
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedGetterWithIdentifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedGetterWithIdentifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp	(working copy)
>@@ -51,6 +51,7 @@ public:
>     {
>         JSTestNamedSetterNoIdentifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedSetterNoIdentifierPrototype>(vm.heap)) JSTestNamedSetterNoIdentifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterNoIdentifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -114,6 +115,7 @@ void JSTestNamedSetterNoIdentifier::fini
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterNoIdentifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedSetterNoIdentifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp	(working copy)
>@@ -51,6 +51,7 @@ public:
>     {
>         JSTestNamedSetterThrowingExceptionPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedSetterThrowingExceptionPrototype>(vm.heap)) JSTestNamedSetterThrowingExceptionPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterThrowingExceptionPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -114,6 +115,7 @@ void JSTestNamedSetterThrowingException:
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterThrowingException"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedSetterThrowingException::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp	(working copy)
>@@ -56,6 +56,7 @@ public:
>     {
>         JSTestNamedSetterWithIdentifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedSetterWithIdentifierPrototype>(vm.heap)) JSTestNamedSetterWithIdentifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithIdentifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -120,6 +121,7 @@ void JSTestNamedSetterWithIdentifier::fi
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithIdentifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedSetterWithIdentifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp	(working copy)
>@@ -59,6 +59,7 @@ public:
>     {
>         JSTestNamedSetterWithIndexedGetterPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedSetterWithIndexedGetterPrototype>(vm.heap)) JSTestNamedSetterWithIndexedGetterPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithIndexedGetterPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -124,6 +125,7 @@ void JSTestNamedSetterWithIndexedGetter:
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithIndexedGetter"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedSetterWithIndexedGetter::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp	(working copy)
>@@ -59,6 +59,7 @@ public:
>     {
>         JSTestNamedSetterWithIndexedGetterAndSetterPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedSetterWithIndexedGetterAndSetterPrototype>(vm.heap)) JSTestNamedSetterWithIndexedGetterAndSetterPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithIndexedGetterAndSetterPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -124,6 +125,7 @@ void JSTestNamedSetterWithIndexedGetterA
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithIndexedGetterAndSetter"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedSetterWithIndexedGetterAndSetter::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.cpp	(working copy)
>@@ -51,6 +51,7 @@ public:
>     {
>         JSTestNamedSetterWithOverrideBuiltinsPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedSetterWithOverrideBuiltinsPrototype>(vm.heap)) JSTestNamedSetterWithOverrideBuiltinsPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithOverrideBuiltinsPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -114,6 +115,7 @@ void JSTestNamedSetterWithOverrideBuilti
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithOverrideBuiltins"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedSetterWithOverrideBuiltins::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.cpp	(working copy)
>@@ -58,6 +58,7 @@ public:
>     {
>         JSTestNamedSetterWithUnforgablePropertiesPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedSetterWithUnforgablePropertiesPrototype>(vm.heap)) JSTestNamedSetterWithUnforgablePropertiesPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithUnforgablePropertiesPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -138,6 +139,7 @@ void JSTestNamedSetterWithUnforgableProp
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithUnforgableProperties"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedSetterWithUnforgableProperties::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.cpp	(working copy)
>@@ -58,6 +58,7 @@ public:
>     {
>         JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltinsPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltinsPrototype>(vm.heap)) JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltinsPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithUnforgablePropertiesAndOverrideBuiltinsPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -138,6 +139,7 @@ void JSTestNamedSetterWithUnforgableProp
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp	(working copy)
>@@ -75,6 +75,7 @@ public:
>     {
>         JSTestNodePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestNodePrototype>(vm.heap)) JSTestNodePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNodePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -212,6 +213,7 @@ void JSTestNode::finishCreation(VM& vm)
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestNode"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestNode::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp	(working copy)
>@@ -1806,6 +1806,7 @@ public:
>     {
>         JSTestObjPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestObjPrototype>(vm.heap)) JSTestObjPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestObjectPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -2440,6 +2441,7 @@ void JSTestObj::finishCreation(VM& vm)
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestObject"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestObj::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp	(working copy)
>@@ -55,6 +55,7 @@ public:
>     {
>         JSTestOverloadedConstructorsPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestOverloadedConstructorsPrototype>(vm.heap)) JSTestOverloadedConstructorsPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestOverloadedConstructorsPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -207,6 +208,7 @@ void JSTestOverloadedConstructors::finis
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestOverloadedConstructors"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestOverloadedConstructors::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp	(working copy)
>@@ -54,6 +54,7 @@ public:
>     {
>         JSTestOverloadedConstructorsWithSequencePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestOverloadedConstructorsWithSequencePrototype>(vm.heap)) JSTestOverloadedConstructorsWithSequencePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestOverloadedConstructorsWithSequencePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -163,6 +164,7 @@ void JSTestOverloadedConstructorsWithSeq
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestOverloadedConstructorsWithSequence"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestOverloadedConstructorsWithSequence::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp	(working copy)
>@@ -59,6 +59,7 @@ public:
>     {
>         JSTestOverrideBuiltinsPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestOverrideBuiltinsPrototype>(vm.heap)) JSTestOverrideBuiltinsPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestOverrideBuiltinsPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -123,6 +124,7 @@ void JSTestOverrideBuiltins::finishCreat
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestOverrideBuiltins"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestOverrideBuiltins::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp	(working copy)
>@@ -50,6 +50,7 @@ public:
>     {
>         JSTestPluginInterfacePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestPluginInterfacePrototype>(vm.heap)) JSTestPluginInterfacePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestPluginInterfacePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -113,6 +114,7 @@ void JSTestPluginInterface::finishCreati
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestPluginInterface"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestPluginInterface::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp	(working copy)
>@@ -134,6 +134,7 @@ public:
>     {
>         JSTestPromiseRejectionEventPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestPromiseRejectionEventPrototype>(vm.heap)) JSTestPromiseRejectionEventPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestPromiseRejectionEventPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -218,6 +219,7 @@ void JSTestPromiseRejectionEvent::finish
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestPromiseRejectionEvent"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestPromiseRejectionEvent::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.cpp	(working copy)
>@@ -91,6 +91,7 @@ public:
>     {
>         JSTestSerializationPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestSerializationPrototype>(vm.heap)) JSTestSerializationPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestSerializationPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -167,6 +168,7 @@ void JSTestSerialization::finishCreation
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestSerialization"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestSerialization::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestSerializationIndirectInheritance.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestSerializationIndirectInheritance.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestSerializationIndirectInheritance.cpp	(working copy)
>@@ -48,6 +48,7 @@ public:
>     {
>         JSTestSerializationIndirectInheritancePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestSerializationIndirectInheritancePrototype>(vm.heap)) JSTestSerializationIndirectInheritancePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestSerializationIndirectInheritancePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -112,6 +113,7 @@ void JSTestSerializationIndirectInherita
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestSerializationIndirectInheritance"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestSerializationIndirectInheritance::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestSerializationInherit.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestSerializationInherit.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestSerializationInherit.cpp	(working copy)
>@@ -58,6 +58,7 @@ public:
>     {
>         JSTestSerializationInheritPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestSerializationInheritPrototype>(vm.heap)) JSTestSerializationInheritPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestSerializationInheritPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -124,6 +125,7 @@ void JSTestSerializationInherit::finishC
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestSerializationInherit"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestSerializationInherit::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestSerializationInheritFinal.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestSerializationInheritFinal.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestSerializationInheritFinal.cpp	(working copy)
>@@ -60,6 +60,7 @@ public:
>     {
>         JSTestSerializationInheritFinalPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestSerializationInheritFinalPrototype>(vm.heap)) JSTestSerializationInheritFinalPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestSerializationInheritFinalPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -127,6 +128,7 @@ void JSTestSerializationInheritFinal::fi
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestSerializationInheritFinal"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestSerializationInheritFinal::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp	(working copy)
>@@ -73,6 +73,7 @@ public:
>     {
>         JSTestSerializedScriptValueInterfacePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestSerializedScriptValueInterfacePrototype>(vm.heap)) JSTestSerializedScriptValueInterfacePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestSerializedScriptValueInterfacePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -143,6 +144,7 @@ void JSTestSerializedScriptValueInterfac
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestSerializedScriptValueInterface"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestSerializedScriptValueInterface::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestStringifier.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestStringifier.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestStringifier.cpp	(working copy)
>@@ -55,6 +55,7 @@ public:
>     {
>         JSTestStringifierPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestStringifierPrototype>(vm.heap)) JSTestStringifierPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -119,6 +120,7 @@ void JSTestStringifier::finishCreation(V
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifier"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestStringifier::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp	(working copy)
>@@ -55,6 +55,7 @@ public:
>     {
>         JSTestStringifierAnonymousOperationPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestStringifierAnonymousOperationPrototype>(vm.heap)) JSTestStringifierAnonymousOperationPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierAnonymousOperationPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -119,6 +120,7 @@ void JSTestStringifierAnonymousOperation
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierAnonymousOperation"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestStringifierAnonymousOperation::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp	(working copy)
>@@ -56,6 +56,7 @@ public:
>     {
>         JSTestStringifierNamedOperationPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestStringifierNamedOperationPrototype>(vm.heap)) JSTestStringifierNamedOperationPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierNamedOperationPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -121,6 +122,7 @@ void JSTestStringifierNamedOperation::fi
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierNamedOperation"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestStringifierNamedOperation::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp	(working copy)
>@@ -56,6 +56,7 @@ public:
>     {
>         JSTestStringifierOperationImplementedAsPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestStringifierOperationImplementedAsPrototype>(vm.heap)) JSTestStringifierOperationImplementedAsPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierOperationImplementedAsPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -121,6 +122,7 @@ void JSTestStringifierOperationImplement
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierOperationImplementedAs"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestStringifierOperationImplementedAs::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp	(working copy)
>@@ -55,6 +55,7 @@ public:
>     {
>         JSTestStringifierOperationNamedToStringPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestStringifierOperationNamedToStringPrototype>(vm.heap)) JSTestStringifierOperationNamedToStringPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierOperationNamedToStringPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -119,6 +120,7 @@ void JSTestStringifierOperationNamedToSt
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierOperationNamedToString"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestStringifierOperationNamedToString::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp	(working copy)
>@@ -57,6 +57,7 @@ public:
>     {
>         JSTestStringifierReadOnlyAttributePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestStringifierReadOnlyAttributePrototype>(vm.heap)) JSTestStringifierReadOnlyAttributePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierReadOnlyAttributePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -122,6 +123,7 @@ void JSTestStringifierReadOnlyAttribute:
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierReadOnlyAttribute"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestStringifierReadOnlyAttribute::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp	(working copy)
>@@ -58,6 +58,7 @@ public:
>     {
>         JSTestStringifierReadWriteAttributePrototype* ptr = new (NotNull, JSC::allocateCell<JSTestStringifierReadWriteAttributePrototype>(vm.heap)) JSTestStringifierReadWriteAttributePrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierReadWriteAttributePrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -123,6 +124,7 @@ void JSTestStringifierReadWriteAttribute
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestStringifierReadWriteAttribute"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestStringifierReadWriteAttribute::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp
>===================================================================
>--- Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp	(revision 246738)
>+++ Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp	(working copy)
>@@ -101,6 +101,7 @@ public:
>     {
>         JSTestTypedefsPrototype* ptr = new (NotNull, JSC::allocateCell<JSTestTypedefsPrototype>(vm.heap)) JSTestTypedefsPrototype(vm, globalObject, structure);
>         ptr->finishCreation(vm);
>+        ptr->putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestTypedefsPrototype"), JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::ReadOnly);
>         return ptr;
>     }
> 
>@@ -226,6 +227,7 @@ void JSTestTypedefs::finishCreation(VM& 
>     Base::finishCreation(vm);
>     ASSERT(inherits(vm, info()));
> 
>+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "TestTypedefs"), JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum);
> }
> 
> JSObject* JSTestTypedefs::createPrototype(VM& vm, JSDOMGlobalObject& globalObject)
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 246738)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.prototype.toString is not spec-perfect
>+        https://bugs.webkit.org/show_bug.cgi?id=199138
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * inspector/model/remote-object-get-properties-expected.txt:
>+        * platform/mac/inspector/model/remote-object-dom-expected.txt:
>+
> 2019-06-24  Greg Doolittle  <gr3g@apple.com>
> 
>         Web Inspector: AXI: Audit: image label test is throwing spurious errors on elements with existing alt attr, but no value: <img alt>
>Index: LayoutTests/imported/w3c/ChangeLog
>===================================================================
>--- LayoutTests/imported/w3c/ChangeLog	(revision 246738)
>+++ LayoutTests/imported/w3c/ChangeLog	(working copy)
>@@ -1,3 +1,16 @@
>+2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.prototype.toString is not spec-perfect
>+        https://bugs.webkit.org/show_bug.cgi?id=199138
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Mark 3 test cases as passing.
>+
>+        * web-platform-tests/WebIDL/ecmascript-binding/default-iterator-object-expected.txt:
>+        * web-platform-tests/WebIDL/ecmascript-binding/interface-prototype-object-expected.txt:
>+        * web-platform-tests/WebIDL/ecmascript-binding/iterator-prototype-object-expected.txt:
>+
> 2019-06-24  Antoine Quint  <graouts@apple.com>
> 
>         [Pointer Events] Respect pointer capture when dispatching mouse boundary events and updating :hover
>Index: LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/default-iterator-object-expected.txt
>===================================================================
>--- LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/default-iterator-object-expected.txt	(revision 246738)
>+++ LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/default-iterator-object-expected.txt	(working copy)
>@@ -1,5 +1,5 @@
> 
> PASS Default iterator objects for an interface have the same prototype 
> PASS Object.prototype.toString returns correct value 
>-FAIL @@toStringTag has correct value from prototype assert_equals: expected (string) "URLSearchParams Iterator" but got (undefined) undefined
>+PASS @@toStringTag has correct value from prototype 
> 
>Index: LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/interface-prototype-object-expected.txt
>===================================================================
>--- LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/interface-prototype-object-expected.txt	(revision 246738)
>+++ LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/interface-prototype-object-expected.txt	(working copy)
>@@ -1,3 +1,3 @@
> 
>-FAIL The class string of an interface prototype object is the concatenation of the interface's identifier and the string 'Prototype'. assert_true: An interface prototype object should have toStringTag property. expected true got false
>+PASS The class string of an interface prototype object is the concatenation of the interface's identifier and the string 'Prototype'. 
> 
>Index: LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/iterator-prototype-object-expected.txt
>===================================================================
>--- LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/iterator-prototype-object-expected.txt	(revision 246738)
>+++ LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/iterator-prototype-object-expected.txt	(working copy)
>@@ -3,6 +3,6 @@ PASS Has %IteratorPrototype% as prototyp
> PASS next() exists and is writable, enumerable, and configurable 
> PASS next() throws TypeError when called on ineligible receiver 
> PASS Object.prototype.toString returns correct value 
>-FAIL @@toStringTag has correct value undefined is not an object (evaluating 'Object.getOwnPropertyDescriptor(iteratorProto, Symbol.toStringTag).value')
>+PASS @@toStringTag has correct value 
> PASS Is specific to an interface 
> 
>Index: LayoutTests/inspector/model/remote-object-get-properties-expected.txt
>===================================================================
>--- LayoutTests/inspector/model/remote-object-get-properties-expected.txt	(revision 246738)
>+++ LayoutTests/inspector/model/remote-object-get-properties-expected.txt	(working copy)
>@@ -235,10 +235,12 @@ description: Event
> 
> OWN PROPERTIES:
>     isTrusted
>+    Symbol(Symbol.toStringTag)
>     __proto__
> 
> DISPLAYABLE PROPERTIES:
>     isTrusted
>+    Symbol(Symbol.toStringTag)
>     type
>     target
>     currentTarget
>@@ -255,6 +257,7 @@ DISPLAYABLE PROPERTIES:
> 
> ALL PROPERTIES:
>     isTrusted
>+    Symbol(Symbol.toStringTag)
>     constructor
>     type
>     target
>@@ -520,6 +523,7 @@ ALL PROPERTIES:
>     item
>     namedItem
>     Symbol(Symbol.iterator)
>+    Symbol(Symbol.toStringTag)
>     toString
>     toLocaleString
>     valueOf
>Index: LayoutTests/platform/mac/inspector/model/remote-object-dom-expected.txt
>===================================================================
>--- LayoutTests/platform/mac/inspector/model/remote-object-dom-expected.txt	(revision 246738)
>+++ LayoutTests/platform/mac/inspector/model/remote-object-dom-expected.txt	(working copy)
>@@ -17,6 +17,11 @@ EXPRESSION: window.loadEvent
>         "_value": "true"
>       },
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "Event"
>+      },
>+      {
>         "_name": "type",
>         "_type": "string",
>         "_value": "load"
>@@ -32,11 +37,6 @@ EXPRESSION: window.loadEvent
>         "_type": "object",
>         "_subtype": "null",
>         "_value": "null"
>-      },
>-      {
>-        "_name": "eventPhase",
>-        "_type": "number",
>-        "_value": "0"
>       }
>     ],
>     "_entries": null
>@@ -58,6 +58,11 @@ EXPRESSION: document.body
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "HTMLBodyElement"
>+      },
>+      {
>         "_name": "aLink",
>         "_type": "string",
>         "_value": ""
>@@ -76,11 +81,6 @@ EXPRESSION: document.body
>         "_name": "link",
>         "_type": "string",
>         "_value": ""
>-      },
>-      {
>-        "_name": "text",
>-        "_type": "string",
>-        "_value": ""
>       }
>     ],
>     "_entries": null
>@@ -102,6 +102,11 @@ EXPRESSION: div = document.createElement
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "HTMLDivElement"
>+      },
>+      {
>         "_name": "align",
>         "_type": "string",
>         "_value": ""
>@@ -120,11 +125,6 @@ EXPRESSION: div = document.createElement
>         "_name": "translate",
>         "_type": "boolean",
>         "_value": "true"
>-      },
>-      {
>-        "_name": "dir",
>-        "_type": "string",
>-        "_value": ""
>       }
>     ],
>     "_entries": null
>@@ -146,6 +146,11 @@ EXPRESSION: span = document.createElemen
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "HTMLSpanElement"
>+      },
>+      {
>         "_name": "title",
>         "_type": "string",
>         "_value": ""
>@@ -164,11 +169,6 @@ EXPRESSION: span = document.createElemen
>         "_name": "dir",
>         "_type": "string",
>         "_value": ""
>-      },
>-      {
>-        "_name": "dataset",
>-        "_type": "object",
>-        "_value": "DOMStringMap"
>       }
>     ],
>     "_entries": null
>@@ -190,6 +190,11 @@ EXPRESSION: input = document.createEleme
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "HTMLInputElement"
>+      },
>+      {
>         "_name": "accept",
>         "_type": "string",
>         "_value": ""
>@@ -208,11 +213,6 @@ EXPRESSION: input = document.createEleme
>         "_name": "autofocus",
>         "_type": "boolean",
>         "_value": "false"
>-      },
>-      {
>-        "_name": "defaultChecked",
>-        "_type": "boolean",
>-        "_value": "false"
>       }
>     ],
>     "_entries": null
>@@ -234,6 +234,11 @@ EXPRESSION: text = document.createTextNo
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "Text"
>+      },
>+      {
>         "_name": "wholeText",
>         "_type": "string",
>         "_value": "text content"
>@@ -253,11 +258,6 @@ EXPRESSION: text = document.createTextNo
>         "_name": "data",
>         "_type": "string",
>         "_value": "text content"
>-      },
>-      {
>-        "_name": "length",
>-        "_type": "number",
>-        "_value": "12"
>       }
>     ],
>     "_entries": null
>@@ -279,6 +279,11 @@ EXPRESSION: comment = document.createCom
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "Comment"
>+      },
>+      {
>         "_name": "data",
>         "_type": "string",
>         "_value": "comment content"
>@@ -299,11 +304,6 @@ EXPRESSION: comment = document.createCom
>         "_type": "object",
>         "_subtype": "null",
>         "_value": "null"
>-      },
>-      {
>-        "_name": "substringData",
>-        "_type": "function",
>-        "_value": ""
>       }
>     ],
>     "_entries": null
>@@ -325,6 +325,11 @@ EXPRESSION: svgElement = document.create
>     "_overflow": true,
>     "_properties": [
>       {
>+        "_name": "Symbol(Symbol.toStringTag)",
>+        "_type": "string",
>+        "_value": "SVGRectElement"
>+      },
>+      {
>         "_name": "x",
>         "_type": "object",
>         "_value": "SVGAnimatedLength"
>@@ -343,11 +348,6 @@ EXPRESSION: svgElement = document.create
>         "_name": "height",
>         "_type": "object",
>         "_value": "SVGAnimatedLength"
>-      },
>-      {
>-        "_name": "rx",
>-        "_type": "object",
>-        "_value": "SVGAnimatedLength"
>       }
>     ],
>     "_entries": null

Actions: View | Formatted Diff | Diff

Attachments on bug 199138: 372719 | 372722 | 372723 | 372725 | 372726 | 372748 | 372771 | 374400 | 374407 | 398257 | 398293 | 398436