[es6] Fix String.prototype.normalize to properly validate argument

BUG=v8:4302
LOG=n

Review URL: https://codereview.chromium.org/1237873003

Cr-Commit-Position: refs/heads/master@{#29683}

src/i18n.js

@@ -1989,14 +1989,14 @@ OverrideFunction(GlobalString.prototype, 'localeCompare', function(that) {
  * If the form is not one of "NFC", "NFD", "NFKC", or "NFKD", then throw
  * a RangeError Exception.
  */
-OverrideFunction(GlobalString.prototype, 'normalize', function(that) {
+OverrideFunction(GlobalString.prototype, 'normalize', function(form) {
     if (%_IsConstructCall()) {
       throw MakeTypeError(kOrdinaryFunctionCalledAsConstructor);
     }
 
     CHECK_OBJECT_COERCIBLE(this, "String.prototype.normalize");
 
-    var form = GlobalString(%_Arguments(0) || 'NFC');
+    form = IS_UNDEFINED(form) ? 'NFC' : form;
 
     var NORMALIZATION_FORMS = ['NFC', 'NFD', 'NFKC', 'NFKD'];
 

src/string.js

@@ -192,7 +192,7 @@ function StringMatchJS(regexp) {
 function StringNormalizeJS(form) {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.normalize");
 
-  var form = form ? TO_STRING_INLINE(form) : 'NFC';
+  var form = IS_UNDEFINED(form) ? 'NFC' : TO_STRING_INLINE(form);
 
   var NORMALIZATION_FORMS = ['NFC', 'NFD', 'NFKC', 'NFKD'];
   var normalizationForm =

test/mjsunit/string-normalize.js

@@ -9,3 +9,11 @@ assertEquals('', ''.normalize());
 assertThrows(function() { ''.normalize('invalid'); }, RangeError);
 assertTrue(delete Array.prototype.join);
 assertThrows(function() { ''.normalize('invalid'); }, RangeError);
+
+// All of these toString to an invalid form argument.
+assertThrows(function() { ''.normalize(null) }, RangeError);
+assertThrows(function() { ''.normalize(true) }, RangeError);
+assertThrows(function() { ''.normalize(false) }, RangeError);
+assertThrows(function() { ''.normalize(42) }, RangeError);
+assertThrows(function() { ''.normalize({}) }, RangeError);
+assertThrows(function() { ''.normalize([]) }, RangeError);