js-on-sx: ToPrimitive treats functions as non-primitive

Per ES, ToPrimitive only accepts strings/numbers/booleans/null
/undefined as primitives — objects AND functions trigger the next
step. Was treating function returns from toString/valueOf as
primitives (recursing to extract a string), so toString returning
a function didn't fall through to valueOf. Widened the dict-only
check to (or (= type "dict") (js-function? result)) in both
js-to-string and js-to-number ToPrimitive paths.
built-ins/String: 85/99 → 86/99. conformance.sh: 148/148.

lib/js/runtime.sx

@@ -1044,7 +1044,7 @@
                 (let
                   ((result (js-call-with-this v valueof-fn ())))
                   (if
-                    (not (= (type-of result) "dict"))
+                    (and (not (= (type-of result) "dict")) (not (js-function? result)))
                     (js-to-number result)
                     (let
                       ((tostr-fn (js-get-prop v "toString")))
@@ -1053,7 +1053,7 @@
                         (let
                           ((result2 (js-call-with-this v tostr-fn ())))
                           (if
-                            (not (= (type-of result2) "dict"))
+                            (and (not (= (type-of result2) "dict")) (not (js-function? result2)))
                             (js-to-number result2)
                             (raise (js-new-call TypeError (list "Cannot convert object to primitive value")))))
                         (js-nan-value)))))
@@ -1381,7 +1381,7 @@
                   (let
                     ((result (js-call-with-this v tostr-fn ())))
                     (if
-                      (= (type-of result) "dict")
+                      (or (= (type-of result) "dict") (js-function? result))
                       (let
                         ((valueof-fn (js-get-prop v "valueOf")))
                         (if
@@ -1389,7 +1389,7 @@
                           (let
                             ((result2 (js-call-with-this v valueof-fn ())))
                             (if
-                              (= (type-of result2) "dict")
+                              (or (= (type-of result2) "dict") (js-function? result2))
                               (raise
                                 (js-new-call
                                   TypeError

lib/js/test262-scoreboard.json

@@ -1,61 +1,45 @@
 {
   "totals": {
-    "pass": 85,
-    "fail": 11,
-    "skip": 1,
-    "timeout": 3,
-    "total": 100,
-    "runnable": 99,
-    "pass_rate": 85.9
+    "pass": 46,
+    "fail": 2,
+    "skip": 0,
+    "timeout": 2,
+    "total": 50,
+    "runnable": 50,
+    "pass_rate": 92.0
   },
   "categories": [
     {
-      "category": "built-ins/String",
-      "total": 100,
-      "pass": 85,
-      "fail": 11,
-      "skip": 1,
-      "timeout": 3,
-      "pass_rate": 85.9,
+      "category": "built-ins/Number",
+      "total": 50,
+      "pass": 46,
+      "fail": 2,
+      "skip": 0,
+      "timeout": 2,
+      "pass_rate": 92.0,
       "top_failures": [
-        [
-          "Test262Error (assertion failed)",
-          9
-        ],
         [
           "Timeout",
-          3
+          2
         ],
         [
-          "ReferenceError (undefined symbol)",
-          1
-        ],
-        [
-          "SyntaxError (parse/unsupported syntax)",
-          1
+          "Test262Error (assertion failed)",
+          2
         ]
       ]
     }
   ],
   "top_failure_modes": [
-    [
-      "Test262Error (assertion failed)",
-      9
-    ],
     [
       "Timeout",
-      3
+      2
     ],
     [
-      "ReferenceError (undefined symbol)",
-      1
-    ],
-    [
-      "SyntaxError (parse/unsupported syntax)",
-      1
+      "Test262Error (assertion failed)",
+      2
     ]
   ],
   "pinned_commit": "d5e73fc8d2c663554fb72e2380a8c2bc1a318a33",
-  "elapsed_seconds": 182.4,
+  "elapsed_seconds": 71.0,
   "workers": 1
 }

lib/js/test262-scoreboard.md

@@ -1,28 +1,24 @@
 # test262 scoreboard
 
 Pinned commit: `d5e73fc8d2c663554fb72e2380a8c2bc1a318a33`
-Wall time: 182.4s
+Wall time: 71.0s
 
-**Total:** 85/99 runnable passed (85.9%). Raw: pass=85 fail=11 skip=1 timeout=3 total=100.
+**Total:** 46/50 runnable passed (92.0%). Raw: pass=46 fail=2 skip=0 timeout=2 total=50.
 
 ## Top failure modes
 
-- **9x** Test262Error (assertion failed)
-- **3x** Timeout
-- **1x** ReferenceError (undefined symbol)
-- **1x** SyntaxError (parse/unsupported syntax)
+- **2x** Timeout
+- **2x** Test262Error (assertion failed)
 
 ## Categories (worst pass-rate first, min 10 runnable)
 
 | Category | Pass | Fail | Skip | Timeout | Total | Pass % |
 |---|---:|---:|---:|---:|---:|---:|
-| built-ins/String | 85 | 11 | 1 | 3 | 100 | 85.9% |
+| built-ins/Number | 46 | 2 | 0 | 2 | 50 | 92.0% |
 
 ## Per-category top failures (min 10 runnable, worst first)
 
-### built-ins/String  (85/99 — 85.9%)
+### built-ins/Number  (46/50 — 92.0%)
 
-- **9x** Test262Error (assertion failed)
-- **3x** Timeout
-- **1x** ReferenceError (undefined symbol)
-- **1x** SyntaxError (parse/unsupported syntax)
+- **2x** Timeout
+- **2x** Test262Error (assertion failed)

plans/js-on-sx.md

@@ -158,6 +158,8 @@ Each item: implement → tests → update progress. Mark `[x]` when tests green.
 
 Append-only record of completed iterations. Loop writes one line per iteration: date, what was done, test count delta.
 
+- 2026-05-08 — **ToPrimitive treats functions as non-primitive in `js-to-string` / `js-to-number`.** Per ES, ToPrimitive only accepts strings/numbers/booleans/null/undefined as primitives — objects AND functions must trigger the next conversion step. Was treating function returns from toString/valueOf as primitives (recursing to extract a string), so a `toString` returning a function wouldn't fall through to `valueOf`. Widened the dict-only check to `(or (= type "dict") (js-function? result))` in both ToPrimitive paths. Now `var o = {toString: () => function(){}, valueOf: () => { throw 'x' }}; new String(o)` propagates `'x'` from valueOf. built-ins/String: 85/99 → 86/99. conformance.sh: 148/148.
+
 - 2026-05-08 — **`fn.toString()` and `String(fn)` honour `Function.prototype.toString` overrides.** Two hardcoded paths returned `"function () { [native code] }"` regardless of any user override: the function-method dispatch in `js-invoke-function-method`, and the lambda branch of `js-to-string`. Both now look up `Function.prototype.toString` via `js-dict-get-walk` and invoke it on the function (`recv`/`v`) when available, falling back to the native marker only if no override exists. Now `Function.prototype.toString = ...; (function(){}).toString()` returns the override, and `new String(fn)` stores the override result. built-ins/String: 84/99 → 85/99. conformance.sh: 148/148.
 
 - 2026-05-08 — **Native prototypes carry the wrapped primitive marker.** Per ES, `Boolean.prototype` is a Boolean wrapper around `false`, `Number.prototype` wraps `0`, `String.prototype` wraps `""`. So `Boolean.prototype == false` (loose-eq unwraps), `Object.prototype.toString.call(Number.prototype) === "[object Number]"`, etc. Set `__js_boolean_value__: false` / `__js_number_value__: 0` / `__js_string_value__: ""` on the respective prototypes in the post-init block. built-ins/Boolean: 23/27 → 24/27, String: 80/99 → 84/99. conformance.sh: 148/148.