The algorithm for Number.prototype.toPrecision has a bug as well as a section that seems unnecessary.
The bug: When execution completes step 10.c.v, m is a string that's ready to be returned to the caller. However, the algorithm doesn't return it at this point, but instead stumbles through steps 11-14, adding unwanted characters to the string before finally returning it to the caller. For example, here are the steps taken for (-12340000).toPrecision(3):
1. x = -12340000
2. skip
3. p = 3
4. skip
5. s = ""
6. then
a. s = "="
b. x = 12340000
7. skip
8. skip
9. skip
10. else
a. e = 7, n = 123
b. m = "123"
c. then
i. a = "1", b = "23"
ii. m = "1.23"
iii. skip
iv. else
1. then
a. c = "+"
2. skip
3. d = "7"
v. m = "-1.23e+7"
11. skip
12. then
a. m = "-1.23e+7."
13. skip
14. return "--1.23e+7."
The unnecessary section: The test e = 0 in 10.c.iii as well as the dependent step 10.c.iii.1 seem unnecessary because from 10.c we know that either e < -6 or e >= p, and from 8 that p >= 1.
Step numbers in draft ES6 are two higher.
fixed in rev 20 editor's draft
fixed in rev20 draft, Oct. 28, 2013
Verified in rev 26 draft.