4 files changed, 45 insertions, 3 deletions
diff --git a/js/src/jsatom.cpp b/js/src/jsatom.cpp
index 3f8e8d8f8..2a3c58638 100644
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -510,6 +510,14 @@ ToAtomSlow(ExclusiveContext* cx, typename MaybeRooted<Value, allowGC>::HandleTyp
         return v.toBoolean() ? cx->names().true_ : cx->names().false_;
     if (v.isNull())
         return cx->names().null;
+    if (v.isSymbol()) {
+        if (cx->shouldBeJSContext() && allowGC) {
+            JS_ReportErrorNumberASCII(cx->asJSContext(), GetErrorMessage, nullptr,
+                                      JSMSG_SYMBOL_TO_STRING);
+        }
+        return nullptr;
+    }
+    MOZ_ASSERT(v.isUndefined());
     return cx->names().undefined;
 }
 
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 2359e28a2..1d44f0ea0 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -2131,9 +2131,10 @@ js::CloneFunctionAndScript(JSContext* cx, HandleFunction fun, HandleObject enclo
  *
  * Function names are always strings. If id is the well-known @@iterator
  * symbol, this returns "[Symbol.iterator]".  If a prefix is supplied the final
- * name is |prefix + " " + name|.
+ * name is |prefix + " " + name|. A prefix cannot be supplied if id is a
+ * symbol value.
  *
- * Implements step 4 and 5 of SetFunctionName in ES 2016 draft Dec 20, 2015.
+ * Implements steps 3-5 of 9.2.11 SetFunctionName in ES2016.
  */
 JSAtom*
 js::IdToFunctionName(JSContext* cx, HandleId id, const char* prefix /* = nullptr */)
@@ -2141,7 +2142,11 @@ js::IdToFunctionName(JSContext* cx, HandleId id, const char* prefix /* = nullptr
     if (JSID_IS_ATOM(id) && !prefix)
         return JSID_TO_ATOM(id);
 
-    if (JSID_IS_SYMBOL(id) && !prefix) {
+    // Step 3.
+    MOZ_ASSERT_IF(prefix, !JSID_IS_SYMBOL(id));
+
+    // Step 4.
+    if (JSID_IS_SYMBOL(id)) {
         RootedAtom desc(cx, JSID_TO_SYMBOL(id)->description());
         StringBuffer sb(cx);
         if (!sb.append('[') || !sb.append(desc) || !sb.append(']'))
@@ -2149,6 +2154,7 @@ js::IdToFunctionName(JSContext* cx, HandleId id, const char* prefix /* = nullptr
         return sb.finishAtom();
     }
 
+    // Step 5.
     RootedValue idv(cx, IdToValue(id));
     if (!prefix)
         return ToAtom<CanGC>(cx, idv);
diff --git a/js/src/tests/ecma_6/RegExp/compile-symbol.js b/js/src/tests/ecma_6/RegExp/compile-symbol.js
new file mode 100644
index 000000000..9eea1124c
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/compile-symbol.js
@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+for (let sym of [Symbol.iterator, Symbol(), Symbol("description")]) {
+    let re = /a/;
+
+    assertEq(re.source, "a");
+    assertThrowsInstanceOf(() => re.compile(sym), TypeError);
+    assertEq(re.source, "a");
+}
+
+if (typeof reportCompare === 'function')
+    reportCompare(0, 0);
diff --git a/js/src/tests/ecma_6/RegExp/constructor-symbol.js b/js/src/tests/ecma_6/RegExp/constructor-symbol.js
new file mode 100644
index 000000000..503d7e5a8
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/constructor-symbol.js
@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+for (let sym of [Symbol.iterator, Symbol(), Symbol("description")]) {
+    assertThrowsInstanceOf(() => RegExp(sym), TypeError);
+    assertThrowsInstanceOf(() => new RegExp(sym), TypeError);
+
+    assertThrowsInstanceOf(() => RegExp(sym, "g"), TypeError);
+    assertThrowsInstanceOf(() => new RegExp(sym, "g"), TypeError);
+}
+
+if (typeof reportCompare === 'function')
+    reportCompare(0, 0);