Bug 1388375 - Don't unbox symbol objects in ValueToId. r=jandem

js/src/jsatominlines.h

@@ -64,8 +64,8 @@ ValueToIdPure(const Value& v, jsid* id)
         return true;
     }
 
-    if (js::IsSymbolOrSymbolWrapper(v)) {
-        *id = SYMBOL_TO_JSID(js::ToSymbolPrimitive(v));
+    if (v.isSymbol()) {
+        *id = SYMBOL_TO_JSID(v.toSymbol());
         return true;
     }
 
@@ -89,8 +89,8 @@ ValueToId(JSContext* cx, typename MaybeRooted<Value, allowGC>::HandleType v,
             return true;
         }
 
-        if (js::IsSymbolOrSymbolWrapper(v)) {
-            idp.set(SYMBOL_TO_JSID(js::ToSymbolPrimitive(v)));
+        if (v.isSymbol()) {
+            idp.set(SYMBOL_TO_JSID(v.toSymbol()));
             return true;
         }
     }

js/src/tests/ecma_6/Symbol/symbol-object-not-unboxed-for-value-to-id.js

@@ -0,0 +1,31 @@
+// Create a symbol and a wrapper for it.
+var s = Symbol();
+var so = Object(s);
+
+// Create a symbol-valued property key using |s|.
+var o = {[s]: 0};
+
+// The default Symbol.prototype[@@toPrimitive] will unbox the symbol object as needed.
+assertEq(o.propertyIsEnumerable(so), true);
+assertEq(o.hasOwnProperty(so), true);
+
+// After redefining Symbol.prototype[@@toPrimitive], any calls to the ToPropertyKey
+// abstract operation will no longer unbox the symbol object.
+Object.defineProperty(Symbol.prototype, Symbol.toPrimitive, {
+    value: function() {
+        return "foo";
+    }
+});
+
+// |o| doesn't have a string-valued property named "foo".
+assertEq(o.propertyIsEnumerable(so), false);
+assertEq(o.hasOwnProperty(so), false);
+
+o.foo = 123;
+
+// After |o.foo| was added, both calls should return true again.
+assertEq(o.propertyIsEnumerable(so), true);
+assertEq(o.hasOwnProperty(so), true);
+
+if (typeof reportCompare === "function")
+    reportCompare(0, 0);

js/src/vm/Symbol.cpp

@@ -143,20 +143,6 @@ js::SymbolDescriptiveString(JSContext* cx, Symbol* sym, MutableHandleValue resul
     return true;
 }
 
-bool
-js::IsSymbolOrSymbolWrapper(const Value& v)
-{
-    return v.isSymbol() || (v.isObject() && v.toObject().is<SymbolObject>());
-}
-
-JS::Symbol*
-js::ToSymbolPrimitive(const Value& v)
-{
-    MOZ_ASSERT(IsSymbolOrSymbolWrapper(v));
-    return v.isSymbol() ? v.toSymbol() : v.toObject().as<SymbolObject>().unbox();
-}
-
-
 JS::ubi::Node::Size
 JS::ubi::Concrete<JS::Symbol>::size(mozilla::MallocSizeOf mallocSizeOf) const
 {

js/src/vm/Symbol.h

@@ -139,20 +139,10 @@ class SymbolRegistry : public GCHashSet<ReadBarrieredSymbol,
     SymbolRegistry() {}
 };
 
-} /* namespace js */
-
-namespace js {
-
 // ES6 rev 27 (2014 Aug 24) 19.4.3.3
 bool
 SymbolDescriptiveString(JSContext* cx, JS::Symbol* sym, JS::MutableHandleValue result);
 
-bool
-IsSymbolOrSymbolWrapper(const JS::Value& v);
-
-JS::Symbol*
-ToSymbolPrimitive(const JS::Value& v);
-
 } /* namespace js */
 
 #endif /* vm_Symbol_h */