the ES6 known symbol toPrimitive allows the user to override the way a function is converted to a primitive type regardless of what type hint is given.
Fixed by your other change: [ES6] Add support for Symbol.toPrimitive https://bugs.webkit.org/show_bug.cgi?id=154877 http://trac.webkit.org/changeset/197531 *** This bug has been marked as a duplicate of bug 154877 ***