util: isEqualBoxedPrimitive: ensure both values are actual boxed Symbols

... before trying to valueOf them

PR-URL: #29029
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Gus Caplan <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Rich Trott <[email protected]>

Author: ljharb

lib/internal/util/comparisons.js

@@ -98,8 +98,11 @@ function isEqualBoxedPrimitive(val1, val2) {
     return isBigIntObject(val2) &&
            BigIntPrototype.valueOf(val1) === BigIntPrototype.valueOf(val2);
   }
-  return isSymbolObject(val2) &&
-         SymbolPrototype.valueOf(val1) === SymbolPrototype.valueOf(val2);
+  if (isSymbolObject(val1)) {
+    return isSymbolObject(val2) &&
+          SymbolPrototype.valueOf(val1) === SymbolPrototype.valueOf(val2);
+  }
+  return false;
 }
 
 // Notes: Type tags are historical [[Class]] properties that can be set by