Reading of Symbol.toStringTag may affect the builtinTag (that should be determined first).

Author: iamstolis

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/builtins/JSClass.java

@@ -244,16 +244,13 @@ public String defaultToString(DynamicObject object) {
     }
 
     protected String getToStringTag(DynamicObject object) {
-        String result = null;
+        String result = getBuiltinToStringTag(object);
         if (JSRuntime.isObject(object)) {
             Object toStringTag = JSObject.get(object, Symbol.SYMBOL_TO_STRING_TAG);
             if (JSRuntime.isString(toStringTag)) {
                 result = JSRuntime.toStringIsString(toStringTag);
             }
         }
-        if (result == null) {
-            result = getBuiltinToStringTag(object);
-        }
         return result;
     }