js-on-sx: ToPrimitive treats functions as non-primitive

Per ES, ToPrimitive only accepts strings/numbers/booleans/null
/undefined as primitives — objects AND functions trigger the next
step. Was treating function returns from toString/valueOf as
primitives (recursing to extract a string), so toString returning
a function didn't fall through to valueOf. Widened the dict-only
check to (or (= type "dict") (js-function? result)) in both
js-to-string and js-to-number ToPrimitive paths.
built-ins/String: 85/99 → 86/99. conformance.sh: 148/148.

plans/js-on-sx.md

@@ -158,6 +158,8 @@ Each item: implement → tests → update progress. Mark `[x]` when tests green.
 
 Append-only record of completed iterations. Loop writes one line per iteration: date, what was done, test count delta.
 
+- 2026-05-08 — **ToPrimitive treats functions as non-primitive in `js-to-string` / `js-to-number`.** Per ES, ToPrimitive only accepts strings/numbers/booleans/null/undefined as primitives — objects AND functions must trigger the next conversion step. Was treating function returns from toString/valueOf as primitives (recursing to extract a string), so a `toString` returning a function wouldn't fall through to `valueOf`. Widened the dict-only check to `(or (= type "dict") (js-function? result))` in both ToPrimitive paths. Now `var o = {toString: () => function(){}, valueOf: () => { throw 'x' }}; new String(o)` propagates `'x'` from valueOf. built-ins/String: 85/99 → 86/99. conformance.sh: 148/148.
+
 - 2026-05-08 — **`fn.toString()` and `String(fn)` honour `Function.prototype.toString` overrides.** Two hardcoded paths returned `"function () { [native code] }"` regardless of any user override: the function-method dispatch in `js-invoke-function-method`, and the lambda branch of `js-to-string`. Both now look up `Function.prototype.toString` via `js-dict-get-walk` and invoke it on the function (`recv`/`v`) when available, falling back to the native marker only if no override exists. Now `Function.prototype.toString = ...; (function(){}).toString()` returns the override, and `new String(fn)` stores the override result. built-ins/String: 84/99 → 85/99. conformance.sh: 148/148.
 
 - 2026-05-08 — **Native prototypes carry the wrapped primitive marker.** Per ES, `Boolean.prototype` is a Boolean wrapper around `false`, `Number.prototype` wraps `0`, `String.prototype` wraps `""`. So `Boolean.prototype == false` (loose-eq unwraps), `Object.prototype.toString.call(Number.prototype) === "[object Number]"`, etc. Set `__js_boolean_value__: false` / `__js_number_value__: 0` / `__js_string_value__: ""` on the respective prototypes in the post-init block. built-ins/Boolean: 23/27 → 24/27, String: 80/99 → 84/99. conformance.sh: 148/148.