jscript: Return the correct string for Object.toString(null) in ES5+ modes.

dlls/jscript/object.c

@@ -57,7 +57,10 @@ static HRESULT Object_toString(script_ctx_t *ctx, jsval_t vthis, WORD flags, uns
     TRACE("\n");
 
     if(is_undefined(vthis) || is_null(vthis)) {
-        str = L"[object Object]";
+        if(ctx->version < SCRIPTLANGUAGEVERSION_ES5)
+            str = L"[object Object]";
+        else
+            str = is_null(vthis) ? L"[object Null]" : L"[object Object]";
         goto set_output;
     }
 

dlls/mshtml/tests/documentmode.js

@@ -1243,7 +1243,7 @@ sync_test("elem_attr", function() {
     r = elem.removeAttribute("ondblclick");
     ok(r === (v < 8 ? false : (v < 9 ? true : undefined)), "ondblclick removeAttribute returned " + r);
     r = Object.prototype.toString.call(elem.ondblclick);
-    todo_wine_if(v >= 9).
+    todo_wine_if(v >= 11).
     ok(r === (v < 8 ? "[object Array]" : (v < 9 ? "[object Object]" : (v < 11 ? "[object Null]" : "[object Function]"))),
         "removed ondblclick Object.toString returned " + r);
 

dlls/mshtml/tests/es5.js

@@ -805,7 +805,6 @@ sync_test("toString", function() {
     todo_wine.
     ok(tmp === "[object Window]", "toString.call(null) = " + tmp);
     tmp = Object.prototype.toString.call(null);
-    todo_wine.
     ok(tmp === "[object Null]", "toString.call(null) = " + tmp);
     tmp = Object.prototype.toString.call(undefined);
     todo_wine.