Bug 1317309: Throw a TypeError when passing a Symbol value to ToAtom. r=till

js/src/jsatom.cpp

@@ -509,6 +509,14 @@ ToAtomSlow(ExclusiveContext* cx, typename MaybeRooted<Value, allowGC>::HandleTyp
         return v.toBoolean() ? cx->names().true_ : cx->names().false_;
     if (v.isNull())
         return cx->names().null;
+    if (v.isSymbol()) {
+        if (cx->shouldBeJSContext() && allowGC) {
+            JS_ReportErrorNumberASCII(cx->asJSContext(), GetErrorMessage, nullptr,
+                                      JSMSG_SYMBOL_TO_STRING);
+        }
+        return nullptr;
+    }
+    MOZ_ASSERT(v.isUndefined());
     return cx->names().undefined;
 }
 

js/src/jsfun.cpp

@@ -2239,9 +2239,10 @@ js::CloneFunctionAndScript(JSContext* cx, HandleFunction fun, HandleObject enclo
  *
  * Function names are always strings. If id is the well-known @@iterator
  * symbol, this returns "[Symbol.iterator]".  If a prefix is supplied the final
- * name is |prefix + " " + name|.
+ * name is |prefix + " " + name|. A prefix cannot be supplied if id is a
+ * symbol value.
  *
- * Implements step 4 and 5 of SetFunctionName in ES 2016 draft Dec 20, 2015.
+ * Implements steps 3-5 of 9.2.11 SetFunctionName in ES2016.
  */
 JSAtom*
 js::IdToFunctionName(JSContext* cx, HandleId id, const char* prefix /* = nullptr */)
@@ -2249,7 +2250,11 @@ js::IdToFunctionName(JSContext* cx, HandleId id, const char* prefix /* = nullptr
     if (JSID_IS_ATOM(id) && !prefix)
         return JSID_TO_ATOM(id);
 
-    if (JSID_IS_SYMBOL(id) && !prefix) {
+    // Step 3.
+    MOZ_ASSERT_IF(prefix, !JSID_IS_SYMBOL(id));
+
+    // Step 4.
+    if (JSID_IS_SYMBOL(id)) {
         RootedAtom desc(cx, JSID_TO_SYMBOL(id)->description());
         StringBuffer sb(cx);
         if (!sb.append('[') || !sb.append(desc) || !sb.append(']'))
@@ -2257,6 +2262,7 @@ js::IdToFunctionName(JSContext* cx, HandleId id, const char* prefix /* = nullptr
         return sb.finishAtom();
     }
 
+    // Step 5.
     RootedValue idv(cx, IdToValue(id));
     if (!prefix)
         return ToAtom<CanGC>(cx, idv);

js/src/tests/ecma_6/RegExp/compile-symbol.js

@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+for (let sym of [Symbol.iterator, Symbol(), Symbol("description")]) {
+    let re = /a/;
+
+    assertEq(re.source, "a");
+    assertThrowsInstanceOf(() => re.compile(sym), TypeError);
+    assertEq(re.source, "a");
+}
+
+if (typeof reportCompare === 'function')
+    reportCompare(0, 0);

js/src/tests/ecma_6/RegExp/constructor-symbol.js

@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+for (let sym of [Symbol.iterator, Symbol(), Symbol("description")]) {
+    assertThrowsInstanceOf(() => RegExp(sym), TypeError);
+    assertThrowsInstanceOf(() => new RegExp(sym), TypeError);
+
+    assertThrowsInstanceOf(() => RegExp(sym, "g"), TypeError);
+    assertThrowsInstanceOf(() => new RegExp(sym, "g"), TypeError);
+}
+
+if (typeof reportCompare === 'function')
+    reportCompare(0, 0);