Upgrade Symbol implementation to match current ES6 behavior.

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index a642230a2885e99653f5190e9f0f555943abe121..e3021e1b0f99188858857d23cb10503e3c89ed14 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -580,14 +580,20 @@ void CallICBase::ReceiverToObjectIfRequired(Handle<Object> callee,
 
   if (callee->IsJSFunction()) {
     Handle<JSFunction> function = Handle<JSFunction>::cast(callee);
-    if (!function->shared()->is_classic_mode() || function->IsBuiltin()) {
+    if (!object->IsSymbol() &&
+        (!function->shared()->is_classic_mode() || function->IsBuiltin())) {
       // Do not wrap receiver for strict mode functions or for builtins.
+      // Symbol receiver are always wrapped; Symbol builtins expect
+      // the wrapped form.
       return;
     }
   }
 
-  // And only wrap string, number or boolean.
-  if (object->IsString() || object->IsNumber() || object->IsBoolean()) {
+  // And only wrap string, number, boolean, or symbol.
+  if (object->IsString() ||
+      object->IsNumber() ||
+      object->IsBoolean() ||
+      object->IsSymbol()) {
     // Change the receiver to the result of calling ToObject on it.
     const int argc = this->target()->arguments_count();
     StackFrameLocator locator(isolate());
@@ -1265,6 +1271,8 @@ Handle<Code> LoadIC::CompileHandler(LookupResult* lookup,
         if (!getter->IsJSFunction()) break;
         if (holder->IsGlobalObject()) break;
         if (!holder->HasFastProperties()) break;
+        // Symbol builtins expect the value to be boxed.
+        if (object->IsSymbol()) break;
         Handle<JSFunction> function = Handle<JSFunction>::cast(getter);
         if (!object->IsJSObject() &&
             !function->IsBuiltin() &&