Upgrade Symbol implementation to match current ES6 behavior.

src/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 562 matching lines @@
 
 void CallICBase::ReceiverToObjectIfRequired(Handle<Object> callee,
                                             Handle<Object> object) {
   while (callee->IsJSFunctionProxy()) {
     callee = Handle<Object>(JSFunctionProxy::cast(*callee)->call_trap(),
                             isolate());
   }
 
   if (callee->IsJSFunction()) {
     Handle<JSFunction> function = Handle<JSFunction>::cast(callee);
-    if (!function->shared()->is_classic_mode() || function->IsBuiltin()) {
+    if (!object->IsSymbol() &&
+        (!function->shared()->is_classic_mode() || function->IsBuiltin())) {
       // Do not wrap receiver for strict mode functions or for builtins.
+      // Symbol receiver are always wrapped; Symbol builtins expect
+      // the wrapped form.
       return;
     }
   }
 
-  // And only wrap string, number or boolean.
-  if (object->IsString() || object->IsNumber() || object->IsBoolean()) {
+  // And only wrap string, number, boolean, or symbol.
+  if (object->IsString() ||
+      object->IsNumber() ||
+      object->IsBoolean() ||
+      object->IsSymbol()) {
     // Change the receiver to the result of calling ToObject on it.
     const int argc = this->target()->arguments_count();
     StackFrameLocator locator(isolate());
     JavaScriptFrame* frame = locator.FindJavaScriptFrame(0);
     int index = frame->ComputeExpressionsCount() - (argc + 1);
     frame->SetExpression(index, *isolate()->factory()->ToObject(object));
   }
 }
 
 
@@ skipping 657 matching lines @@
             Handle<ExecutableAccessorInfo>::cast(callback);
         if (v8::ToCData<Address>(info->getter()) == 0) break;
         if (!info->IsCompatibleReceiver(*object)) break;
         return compiler.CompileLoadCallback(type, holder, name, info);
       } else if (callback->IsAccessorPair()) {
         Handle<Object> getter(Handle<AccessorPair>::cast(callback)->getter(),
                               isolate());
         if (!getter->IsJSFunction()) break;
         if (holder->IsGlobalObject()) break;
         if (!holder->HasFastProperties()) break;
+        // Symbol builtins expect the value to be boxed.
+        if (object->IsSymbol()) break;
         Handle<JSFunction> function = Handle<JSFunction>::cast(getter);
         if (!object->IsJSObject() &&
             !function->IsBuiltin() &&
             function->shared()->is_classic_mode()) {
           // Calling non-strict non-builtins with a value as the receiver
           // requires boxing.
           break;
         }
         CallOptimization call_optimization(function);
         if (call_optimization.is_simple_api_call() &&
@@ skipping 1914 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal