[es6] Fix String.prototype.normalize to properly validate argument

src/string.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
@@ skipping 174 matching lines @@
 
 
 // ECMA-262 v6, section 21.1.3.12
 //
 // For now we do nothing, as proper normalization requires big tables.
 // If Intl is enabled, then i18n.js will override it and provide the the
 // proper functionality.
 function StringNormalizeJS(form) {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.normalize");
 
-  var form = form ? TO_STRING_INLINE(form) : 'NFC';
+  var form = IS_UNDEFINED(form) ? 'NFC' : TO_STRING_INLINE(form);
 
   var NORMALIZATION_FORMS = ['NFC', 'NFD', 'NFKC', 'NFKD'];
   var normalizationForm =
       %_CallFunction(NORMALIZATION_FORMS, form, ArrayIndexOf);
   if (normalizationForm === -1) {
     throw MakeRangeError(kNormalizationForm,
                          %_CallFunction(NORMALIZATION_FORMS, ', ', ArrayJoin));
   }
 
   return %_ValueOf(this);
@@ skipping 992 matching lines @@
   to.StringIndexOf = StringIndexOfJS;
   to.StringLastIndexOf = StringLastIndexOfJS;
   to.StringMatch = StringMatchJS;
   to.StringReplace = StringReplace;
   to.StringSplit = StringSplitJS;
   to.StringSubstr = StringSubstr;
   to.StringSubstring = StringSubstring;
 });
 
 })