[es6] Fix invalid ToObject in String/Array iterator next.

src/string-iterator.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 23 matching lines @@
   var s = TO_STRING_INLINE(string);
   var iterator = new StringIterator;
   SET_PRIVATE(iterator, stringIteratorIteratedStringSymbol, s);
   SET_PRIVATE(iterator, stringIteratorNextIndexSymbol, 0);
   return iterator;
 }
 
 
 // 21.1.5.2.1 %StringIteratorPrototype%.next( )
 function StringIteratorNext() {
-  var iterator = TO_OBJECT(this);
+  var iterator = this;
 
-  if (!HAS_DEFINED_PRIVATE(iterator, stringIteratorNextIndexSymbol)) {
+  if (!IS_SPEC_OBJECT(iterator) ||
+      !HAS_DEFINED_PRIVATE(iterator, stringIteratorNextIndexSymbol)) {
     throw MakeTypeError(kIncompatibleMethodReceiver,
                         'String Iterator.prototype.next');
   }
 
   var s = GET_PRIVATE(iterator, stringIteratorIteratedStringSymbol);
   if (IS_UNDEFINED(s)) {
     return ArrayIteratorCreateResultObject(UNDEFINED, true);
   }
 
   var position = GET_PRIVATE(iterator, stringIteratorNextIndexSymbol);
@@ skipping 37 matching lines @@
   'next', StringIteratorNext
 ]);
 %AddNamedProperty(StringIterator.prototype, toStringTagSymbol,
                   "String Iterator", READ_ONLY | DONT_ENUM);
 
 utils.SetFunctionName(StringPrototypeIterator, iteratorSymbol);
 %AddNamedProperty(GlobalString.prototype, iteratorSymbol,
                   StringPrototypeIterator, DONT_ENUM);
 
 })