Add a realm check when unboxing boxes

spec/abstract-operations.html

@@ -767,16 +767,15 @@ <h1>
     <emu-clause id="sec-samevaluenongeneric" type="abstract operation" oldids="sec-samevaluenonnumeric sec-samevaluenonnumber">
       <h1>
         <del>SameValueNonNumeric</del><ins>SameValueNonGeneric</ins> (
-          _x_: an ECMAScript language value, but not a Number or a BigInt,
-          _y_: an ECMAScript language value, but not a Number or a BigInt,
+          _x_: an ECMAScript language value, but not a Number, a BigInt, a Record, or a Tuple,
+          _y_: an ECMAScript language value, but not a Number, a BigInt, a Record, or a Tuple,
         )
       </h1>
       <dl class="header">
         <dt>description</dt>
         <dd>It returns a completion record whose [[Type]] is ~normal~ and whose [[Value]] is a Boolean.</dd>
       </dl>
       <emu-alg>
-        1. Assert: Type(_x_) is not Number or BigInt.
         1. Assert: Type(_x_) is the same as Type(_y_).
         1. If Type(_x_) is Undefined, return *true*.
         1. If Type(_x_) is Null, return *true*.
@@ -787,9 +786,7 @@ <h1>
         1. If Type(_x_) is Symbol, then
           1. If _x_ and _y_ are both the same Symbol value, return *true*; otherwise, return *false*.
         1. <ins>If Type(_x_) is Box, then</ins>
-          1. <ins>Set _x_ to _x_.[[Value]].</ins>
-          1. <ins>Set _y_ to _y_.[[Value]].</ins>
-        1. <ins>Assert: Type(_x_) and Type(_y_) is Object.</ins>
+          1. <ins>Return ! BoxSameValue(_x_, _y_)</ins>
         1. If _x_ and _y_ are the same Object value, return *true*. Otherwise, return *false*.
       </emu-alg>
     </emu-clause>

spec/data-types-and-values.html

@@ -169,10 +169,42 @@ <h1>
         </h1>
         <dl class="header"></dl>
         <emu-alg>
-          1. Let _valueString_ be ? ToString(_argument_.[[Value]]).
+          1. Let _value_ be ? Unbox(_argument_).
+          1. Let _valueString_ be ? ToString(_value_).
           1. Return the string-concatenation of *"Box("*, _valueString_, and *")"*.
         </emu-alg>
       </emu-clause>
+
+      <emu-clause id="sec-ecmascript-language-types-box-unbox" type="abstract operation">
+        <h1>
+          Unbox (
+            _box_: a Box,
+          )
+        </h1>
+        <dl class="header">
+          <dt>description</dt>
+          <dd>It extracts the boxed Object from _box_, throwing if it has been boxed by a different Realm's Box constructor.</dd>
+        </dl>
+        <emu-alg>
+          1. Let _realm_ be the current Realm Record.
+          1. If _box_.[[Realm]] is not _realm_, throw a TypeError exception.
+          1. Return _box_.[[Value]].
+        </emu-alg>
+      </emu-clause>
+
+      <emu-clause id="sec-immutable-types-record-sameValue" type="abstract operation">
+        <h1>
+          BoxSameValue (
+            _x_: a Box,
+            _y_: a Box,
+          )
+        </h1>
+        <dl class="header"></dl>
+        <emu-alg>
+          1. If _x_.[[Realm]] is not _y_.[[Realm]], return *false*.
+          1. Return ! SameValueNonGeneric(_x_.[[Value]], _y_.[[Value]]).
+        </emu-alg>
+      </emu-clause>
     </emu-clause>
   </emu-clause>
 </emu-clause>

spec/immutable-data-structures.html

@@ -638,7 +638,8 @@ <h1>Box ( _arg_ )</h1>
         <emu-alg>
           1. If NewTarget is not *undefined*, throw a *TypeError* exception.
           1. If Type(_arg_) is not Object, throw a *TypeError* exception.
-          1. Return a new Box value whose [[Value]] is _arg_.
+          1. Let _realm_ be the current Realm Record.
+          1. Return a new Box value whose [[Value]] is _arg_ and whose [[Realm]] is _realm_.
         </emu-alg>
       </emu-clause>
     </emu-clause>
@@ -681,7 +682,7 @@ <h1>Box.unbox ( _value_ )</h1>
         <p>When the `unbox` function is called, the following steps are taken:</p>
         <emu-alg>
           1. Let _box_ be ? thisBoxValue(_value_).
-          1. Return _box_.[[Value]].
+          1. Return ? Unbox(_box_).
         </emu-alg>
       </emu-clause>
 

spec/structured-data.html

@@ -143,15 +143,15 @@ <h1>
               1. <ins>Set _toJSONCalled_ to *true*.</ins>
           1. If _state_.[[ReplacerFunction]] is not *undefined*, then
             1. Set _value_ to ? Call(_state_.[[ReplacerFunction]], _holder_, &laquo; _key_, _value_ &raquo;).
-            1. <ins>Set _value_ to ! MaybeUnwrapBox(_value_).</ins>
+            1. <ins>Set _value_ to ? MaybeUnwrapBox(_value_).</ins>
           1. <ins>Else,</ins>
-            1. <ins>Set _value_ to ! MaybeUnwrapBox(_value_).</ins>
+            1. <ins>Set _value_ to ? MaybeUnwrapBox(_value_).</ins>
             1. <ins>If _toJSONCalled_ is *false*, then</ins>
               1. <ins>If Type(_value_) is Object or BigInt, then</ins>
               1. <ins>Let _toJSON_ be ? GetV(_value_, *"toJSON"*).</ins>
               1. <ins>If IsCallable(_toJSON_) is *true*, then</ins>
                 1. <ins>Set _value_ to ? Call(_toJSON_, _value_, &laquo; _key_ &raquo;).</ins>
-                1. <ins>Set _value_ to ! MaybeUnwrapBox(_value_).</ins>
+                1. <ins>Set _value_ to ? MaybeUnwrapBox(_value_).</ins>
           1. If Type(_value_) is Object, then
             1. If _value_ has a [[NumberData]] internal slot, then
               1. Set _value_ to ? ToNumber(_value_).
@@ -192,7 +192,7 @@ <h1>
         <emu-alg>
           1. If Type(_value_) is Object and _value_ has a [[BoxData]] internal slot,
             1. Set _value_ to _value_.[[BoxData]].
-          1. If Type(_value_) is Box, return _value_.[[Value]].
+          1. If Type(_value_) is Box, return ? Unbox(_value_).
           1. Return _value_.
         </emu-alg>
       </emu-clause>