Add `CheckObjectCoercible` for the `String.prototype` HTML methods

src/string.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file relies on the fact that the following declaration has been made
 // in runtime.js:
 // var $String = global.String;
 
 // -------------------------------------------------------------------
 
@@ skipping 688 matching lines @@
         end_i = start_i;
         start_i = tmp;
       }
     }
   }
 
   return %_SubString(s, start_i, end_i);
 }
 
 
-// This is not a part of ECMA-262.
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.1
 function StringSubstr(start, n) {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.substr");
 
   var s = TO_STRING_INLINE(this);
   var len;
 
   // Correct n: If not given, set to string length; if explicitly
   // set to undefined, zero, or negative, returns empty string.
   if (IS_UNDEFINED(n)) {
     len = s.length;
@@ skipping 100 matching lines @@
   var two_byte = %NewString(n - i, NEW_TWO_BYTE_STRING);
   for (var j = 0; i < n; i++, j++) {
     var code = %_Arguments(i);
     if (!%_IsSmi(code)) code = ToNumber(code) & 0xffff;
     %_TwoByteSeqStringSetChar(two_byte, j, code);
   }
   return one_byte + two_byte;
 }
 
 
-// Helper function for very basic XSS protection.
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.2.1
 function HtmlEscape(str) {
   return TO_STRING_INLINE(str).replace(/</g, "&lt;")
                               .replace(/>/g, "&gt;")
                               .replace(/"/g, "&quot;")
                               .replace(/'/g, "&#039;");
 }
 
 
-// Compatibility support for KJS.
-// Tested by mozilla/js/tests/js1_5/Regress/regress-276103.js.
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.2
+function StringAnchor(name) {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.anchor");
+  return "<a name=\"" + HtmlEscape(name) + "\">" + this + "</a>";
+}
+
+
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.3
+function StringBig() {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.big");
+  return "<big>" + this + "</big>";
+}
+
+
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.4
+function StringBlink() {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.blink");
+  return "<blink>" + this + "</blink>";
+}
+
+
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.5
+function StringBold() {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.bold");
+  return "<b>" + this + "</b>";
+}
+
+
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.6
+function StringFixed() {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.fixed");
+  return "<tt>" + this + "</tt>";
+}
+
+
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.7
+function StringFontcolor(color) {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.fontcolor");
+  return "<font color=\"" + HtmlEscape(color) + "\">" + this + "</font>";
+}
+
+
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.8
+function StringFontsize(size) {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.fontsize");
+  return "<font size=\"" + HtmlEscape(size) + "\">" + this + "</font>";
+}
+
+
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.9
+function StringItalics() {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.italics");
+  return "<i>" + this + "</i>";
+}
+
+
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.10
 function StringLink(s) {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.link");
   return "<a href=\"" + HtmlEscape(s) + "\">" + this + "</a>";
 }
 
 
-function StringAnchor(name) {
-  return "<a name=\"" + HtmlEscape(name) + "\">" + this + "</a>";
-}
-
-
-function StringFontcolor(color) {
-  return "<font color=\"" + HtmlEscape(color) + "\">" + this + "</font>";
-}
-
-
-function StringFontsize(size) {
-  return "<font size=\"" + HtmlEscape(size) + "\">" + this + "</font>";
-}
-
-
-function StringBig() {
-  return "<big>" + this + "</big>";
-}
-
-
-function StringBlink() {
-  return "<blink>" + this + "</blink>";
-}
-
-
-function StringBold() {
-  return "<b>" + this + "</b>";
-}
-
-
-function StringFixed() {
-  return "<tt>" + this + "</tt>";
-}
-
-
-function StringItalics() {
-  return "<i>" + this + "</i>";
-}
-
-
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.11
 function StringSmall() {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.small");
   return "<small>" + this + "</small>";
 }
 
 
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.12
 function StringStrike() {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.strike");
   return "<strike>" + this + "</strike>";
 }
 
 
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.13
 function StringSub() {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.sub");
   return "<sub>" + this + "</sub>";
 }
 
 
+// ES6 draft, revision 26 (2014-07-18), section B.2.3.14
 function StringSup() {
+  CHECK_OBJECT_COERCIBLE(this, "String.prototype.sup");
   return "<sup>" + this + "</sup>";
 }
 
 // -------------------------------------------------------------------
 
 function SetUpString() {
   %CheckIsBootstrapping();
 
   // Set the String function and constructor.
   %SetCode($String, StringConstructor);
@@ skipping 42 matching lines @@
     "fixed", StringFixed,
     "italics", StringItalics,
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup
   ));
 }
 
 SetUpString();