From: rossberg@chromium.org <rossberg@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Wed, 16 Jul 2014 09:26:11 +0000 (+0000)
Subject: Make ToPrimitive throw on symbol wrappers
X-Git-Tag: upstream/4.7.83~8202
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=96dd1c783171ffb21c075a2f001d0500635b1cdd;p=platform%2Fupstream%2Fv8.git

Make ToPrimitive throw on symbol wrappers

R=mstarzinger@chromium.org
BUG=v8:3442
LOG=Y

Review URL: https://codereview.chromium.org/389263003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22426 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/runtime.js b/src/runtime.js
index 1dee2e0..c070a11 100644
--- a/src/runtime.js
+++ b/src/runtime.js
@@ -607,35 +607,37 @@ function IsPrimitive(x) {
 
 // ECMA-262, section 8.6.2.6, page 28.
 function DefaultNumber(x) {
-  var valueOf = x.valueOf;
-  if (IS_SPEC_FUNCTION(valueOf)) {
-    var v = %_CallFunction(x, valueOf);
-    if (%IsPrimitive(v)) return v;
-  }
+  if (!IS_SYMBOL_WRAPPER(x)) {
+    var valueOf = x.valueOf;
+    if (IS_SPEC_FUNCTION(valueOf)) {
+      var v = %_CallFunction(x, valueOf);
+      if (%IsPrimitive(v)) return v;
+    }
 
-  var toString = x.toString;
-  if (IS_SPEC_FUNCTION(toString)) {
-    var s = %_CallFunction(x, toString);
-    if (%IsPrimitive(s)) return s;
+    var toString = x.toString;
+    if (IS_SPEC_FUNCTION(toString)) {
+      var s = %_CallFunction(x, toString);
+      if (%IsPrimitive(s)) return s;
+    }
   }
-
   throw %MakeTypeError('cannot_convert_to_primitive', []);
 }
 
 // ECMA-262, section 8.6.2.6, page 28.
 function DefaultString(x) {
-  var toString = x.toString;
-  if (IS_SPEC_FUNCTION(toString)) {
-    var s = %_CallFunction(x, toString);
-    if (%IsPrimitive(s)) return s;
-  }
+  if (!IS_SYMBOL_WRAPPER(x)) {
+    var toString = x.toString;
+    if (IS_SPEC_FUNCTION(toString)) {
+      var s = %_CallFunction(x, toString);
+      if (%IsPrimitive(s)) return s;
+    }
 
-  var valueOf = x.valueOf;
-  if (IS_SPEC_FUNCTION(valueOf)) {
-    var v = %_CallFunction(x, valueOf);
-    if (%IsPrimitive(v)) return v;
+    var valueOf = x.valueOf;
+    if (IS_SPEC_FUNCTION(valueOf)) {
+      var v = %_CallFunction(x, valueOf);
+      if (%IsPrimitive(v)) return v;
+    }
   }
-
   throw %MakeTypeError('cannot_convert_to_primitive', []);
 }
 
diff --git a/test/mjsunit/es6/symbols.js b/test/mjsunit/es6/symbols.js
index b465bee..7c211ca 100644
--- a/test/mjsunit/es6/symbols.js
+++ b/test/mjsunit/es6/symbols.js
@@ -102,7 +102,9 @@ TestConstructor()
 
 function TestValueOf() {
   for (var i in symbols) {
+    assertTrue(symbols[i] === Object(symbols[i]).valueOf())
     assertTrue(symbols[i] === symbols[i].valueOf())
+    assertTrue(Symbol.prototype.valueOf.call(Object(symbols[i])) === symbols[i])
     assertTrue(Symbol.prototype.valueOf.call(symbols[i]) === symbols[i])
   }
 }
@@ -113,7 +115,7 @@ function TestToString() {
   for (var i in symbols) {
     assertThrows(function() { String(symbols[i]) }, TypeError)
     assertThrows(function() { symbols[i] + "" }, TypeError)
-    assertTrue(isValidSymbolString(String(Object(symbols[i]))))
+    assertThrows(function() { String(Object(symbols[i])) }, TypeError)
     assertTrue(isValidSymbolString(symbols[i].toString()))
     assertTrue(isValidSymbolString(Object(symbols[i]).toString()))
     assertTrue(
@@ -127,6 +129,8 @@ TestToString()
 
 function TestToBoolean() {
   for (var i in symbols) {
+    assertTrue(Boolean(Object(symbols[i])))
+    assertFalse(!Object(symbols[i]))
     assertTrue(Boolean(symbols[i]).valueOf())
     assertFalse(!symbols[i])
     assertTrue(!!symbols[i])
@@ -144,6 +148,8 @@ TestToBoolean()
 
 function TestToNumber() {
   for (var i in symbols) {
+    assertThrows(function() { Number(Object(symbols[i])) }, TypeError)
+    assertThrows(function() { +Object(symbols[i]) }, TypeError)
     assertSame(NaN, Number(symbols[i]).valueOf())
     assertSame(NaN, symbols[i] + 0)
   }