[es6] Fix invalid ToObject in String/Array iterator next.

src/array-iterator.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var $arrayValues;
 
 (function(global, utils) {
 
 "use strict";
 
@@ skipping 58 matching lines @@
 
 
 // 22.1.5.2.2 %ArrayIteratorPrototype%[@@iterator]
 function ArrayIteratorIterator() {
     return this;
 }
 
 
 // 15.4.5.2.2 ArrayIterator.prototype.next( )
 function ArrayIteratorNext() {
-  var iterator = TO_OBJECT(this);
+  var iterator = this;
 
-  if (!HAS_DEFINED_PRIVATE(iterator, arrayIteratorNextIndexSymbol)) {
+  if (!IS_SPEC_OBJECT(iterator) ||
+      !HAS_DEFINED_PRIVATE(iterator, arrayIteratorNextIndexSymbol)) {

[Jarin, 2015/09/02 06:41:01]

Technically, you should check for presence of the other internal fields, but I
suppose that if arrayIteratorNextIndexSymbol is there, the others have to be
there as well. Could you add a comment that explains this?

[Benedikt Meurer, 2015/09/02 06:42:05]

Yeah, I'll remove all of this soonish and replace with a dedicated instance
type. So this problem will disappear.

     throw MakeTypeError(kIncompatibleMethodReceiver,
                         'Array Iterator.prototype.next', this);
   }
 
   var array = GET_PRIVATE(iterator, arrayIteratorObjectSymbol);
   if (IS_UNDEFINED(array)) {
     return CreateIteratorResultObject(UNDEFINED, true);
   }
 
   var index = GET_PRIVATE(iterator, arrayIteratorNextIndexSymbol);
@@ skipping 76 matching lines @@
 
 utils.Export(function(to) {
   to.ArrayIteratorCreateResultObject = CreateIteratorResultObject;
 });
 
 $arrayValues = ArrayValues;
 
 %InstallToContext(["array_values_iterator", ArrayValues]);
 
 })