util: isEqualBoxedPrimitive: ensure both values are actual boxed Symbols

... before trying to valueOf them

PR-URL: #29029
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Rich Trott <rtrott@gmail.com>

Author: ljharb

lib/internal/util/comparisons.js

@@ -98,8 +98,11 @@ function isEqualBoxedPrimitive(val1, val2) {
     return isBigIntObject(val2) &&
            BigIntPrototype.valueOf(val1) === BigIntPrototype.valueOf(val2);
   }
-  return isSymbolObject(val2) &&
-         SymbolPrototype.valueOf(val1) === SymbolPrototype.valueOf(val2);
+  if (isSymbolObject(val1)) {
+    return isSymbolObject(val2) &&
+          SymbolPrototype.valueOf(val1) === SymbolPrototype.valueOf(val2);
+  }
+  return false;
 }
 
 // Notes: Type tags are historical [[Class]] properties that can be set by