[es6] Fix invalid ToObject in String/Array iterator next.

src/array-iterator.js

Index: src/array-iterator.js
diff --git a/src/array-iterator.js b/src/array-iterator.js
index e59bfd782ab0f24f5c76b3d1cd108fddfed1a6f6..762714e0e377233b65412b54dc02002735e0732a 100644
--- a/src/array-iterator.js
+++ b/src/array-iterator.js
@@ -76,9 +76,10 @@ function ArrayIteratorIterator() {
 
 // 15.4.5.2.2 ArrayIterator.prototype.next( )
 function ArrayIteratorNext() {
-  var iterator = TO_OBJECT(this);
+  var iterator = this;
 
-  if (!HAS_DEFINED_PRIVATE(iterator, arrayIteratorNextIndexSymbol)) {
+  if (!IS_SPEC_OBJECT(iterator) ||
+      !HAS_DEFINED_PRIVATE(iterator, arrayIteratorNextIndexSymbol)) {

[Jarin, 2015/09/02 06:41:01]

Technically, you should check for presence of the other internal fields, but I
suppose that if arrayIteratorNextIndexSymbol is there, the others have to be
there as well. Could you add a comment that explains this?

[Benedikt Meurer, 2015/09/02 06:42:05]

Yeah, I'll remove all of this soonish and replace with a dedicated instance
type. So this problem will disappear.

     throw MakeTypeError(kIncompatibleMethodReceiver,
                         'Array Iterator.prototype.next', this);
   }