[es6] Fix String.prototype.normalize to properly validate argument

test/mjsunit/string-normalize.js

Index: test/mjsunit/string-normalize.js
diff --git a/test/mjsunit/string-normalize.js b/test/mjsunit/string-normalize.js
index f88f193a091fbab46d15685cf10ea755a7f501fd..d8ae74d4eaf12c49409299cef14d56032697f330 100644
--- a/test/mjsunit/string-normalize.js
+++ b/test/mjsunit/string-normalize.js
@@ -9,3 +9,11 @@ assertEquals('', ''.normalize());
 assertThrows(function() { ''.normalize('invalid'); }, RangeError);
 assertTrue(delete Array.prototype.join);
 assertThrows(function() { ''.normalize('invalid'); }, RangeError);
+
+// All of these toString to an invalid form argument.
+assertThrows(function() { ''.normalize(null) }, RangeError);
+assertThrows(function() { ''.normalize(true) }, RangeError);
+assertThrows(function() { ''.normalize(false) }, RangeError);
+assertThrows(function() { ''.normalize(42) }, RangeError);
+assertThrows(function() { ''.normalize({}) }, RangeError);
+assertThrows(function() { ''.normalize([]) }, RangeError);