Remove lingering defaultValue calls with hint JSTYPE_OBJECT or JSTYPE_FUNCTION (554550, r=brendan).

js/src/jsiter.cpp

@@ -206,15 +206,10 @@ Iterator(JSContext *cx, JSObject *iterobj, uintN argc, jsval *argv, jsval *rval)
     flags = keyonly ? 0 : JSITER_FOREACH;
 
     if (JS_IsConstructing(cx)) {
-        /* XXX work around old valueOf call hidden beneath js_ValueToObject */
-        if (!JSVAL_IS_PRIMITIVE(argv[0])) {
-            obj = JSVAL_TO_OBJECT(argv[0]);
-        } else {
-            obj = js_ValueToNonNullObject(cx, argv[0]);
-            if (!obj)
-                return JS_FALSE;
-            argv[0] = OBJECT_TO_JSVAL(obj);
-        }
+        obj = js_ValueToNonNullObject(cx, argv[0]);
+        if (!obj)
+            return false;
+        argv[0] = OBJECT_TO_JSVAL(obj);
         return InitNativeIterator(cx, iterobj, obj, flags);
     }
 
@@ -363,15 +358,16 @@ js_ValueToIterator(JSContext *cx, uintN flags, jsval *vp)
 
     AutoValueRooter tvr(cx);
 
-    /* XXX work around old valueOf call hidden beneath js_ValueToObject */
     if (!JSVAL_IS_PRIMITIVE(*vp)) {
+        /* Common case. */
         obj = JSVAL_TO_OBJECT(*vp);
     } else {
         /*
          * Enumerating over null and undefined gives an empty enumerator.
          * This is contrary to ECMA-262 9.9 ToObject, invoked from step 3 of
          * the first production in 12.6.4 and step 4 of the second production,
-         * but it's "web JS" compatible.
+         * but it's "web JS" compatible. ES5 fixed for-in to match this de-facto
+         * standard.
          */
         if ((flags & JSITER_ENUMERATE)) {
             if (!js_ValueToObject(cx, *vp, &obj))