js-on-sx: fn.toString honours Function.prototype.toString overrides

Two hardcoded paths returned the native marker regardless of user
override: js-invoke-function-method and the lambda branch of
js-to-string. Both now look up Function.prototype.toString via
js-dict-get-walk and invoke it on the function, falling back to
the native marker only if no override exists.
built-ins/String: 84/99 → 85/99. conformance.sh: 148/148.

lib/js/runtime.sx

@@ -306,7 +306,13 @@
           (fn
             (&rest more)
             (js-call-with-this this-arg recv (js-list-concat bound more)))))
-      ((= key "toString") "function () { [native code] }")
+      ((= key "toString")
+        (let
+          ((override (js-dict-get-walk (get js-function-global "prototype") "toString")))
+          (if
+            (= (type-of override) "lambda")
+            (js-call-with-this recv override args)
+            "function () { [native code] }")))
       ((= key "name") (js-extract-fn-name recv))
       ((= key "length") (js-fn-length recv))
       (else :js-undefined))))
@@ -1393,7 +1399,18 @@
                           "[object Object]"))
                       (js-to-string result)))
                   "[object Object]"))))
-          (if (= (type-of v) "list") (js-list-join v ",") (str v)))))))
+          (cond
+            ((= (type-of v) "list") (js-list-join v ","))
+            ((js-function? v)
+              (let
+                ((tostr-fn (js-dict-get-walk (get js-function-global "prototype") "toString")))
+                (if
+                  (= (type-of tostr-fn) "lambda")
+                  (let
+                    ((result (js-call-with-this v tostr-fn ())))
+                    (if (= (type-of result) "string") result "function () { [native code] }"))
+                  "function () { [native code] }")))
+            (else (str v))))))))
 
 (define
   js-template-concat