ThrowTypeError should not be constructable, so shouldn't have a prototype.

In addition to ThrowTypeError not being a constructor, it was invalidly set up by simply swapping the map. Swapping the map is insufficient since NewFunction* actually set up the function depending on the used map.

BUG=chromium:573858
LOG=n

Review URL: https://codereview.chromium.org/1552223002

Cr-Commit-Position: refs/heads/master@{#33082}

src/bootstrapper.cc

@@ -672,7 +672,6 @@ Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic(
   Handle<Code> code(isolate()->builtins()->builtin(builtin_name));
   Handle<JSFunction> function =
       factory()->NewFunctionWithoutPrototype(name, code);
-  function->set_map(native_context()->sloppy_function_map());
   function->shared()->DontAdaptArguments();
 
   // %ThrowTypeError% must not have a name property.

test/mjsunit/regress/regress-crbug-573858.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var throw_type_error = Object.getOwnPropertyDescriptor(
+    (function() {"use strict"}).__proto__, "caller").get;
+
+function create_initial_map() { this instanceof throw_type_error }
+%OptimizeFunctionOnNextCall(create_initial_map);
+create_initial_map();
+
+function test() { new throw_type_error }
+%OptimizeFunctionOnNextCall(test);
+assertThrows(test);

test/mjsunit/strict-mode.js

@@ -1018,11 +1018,7 @@ function CheckFunctionPillDescriptor(func, name) {
     assertThrows(function() { 'use strict'; pill.property = "value"; },
                  TypeError);
     assertThrows(pill, TypeError);
-    assertEquals(pill.prototype, (function(){}).prototype);
-    var d = Object.getOwnPropertyDescriptor(pill, "prototype");
-    assertFalse(d.writable);
-    assertFalse(d.configurable);
-    assertFalse(d.enumerable);
+    assertEquals(undefined, pill.prototype);
   }
 
   // Poisoned accessors are no longer own properties
@@ -1046,11 +1042,7 @@ function CheckArgumentsPillDescriptor(func, name) {
     assertThrows(function() { 'use strict'; pill.property = "value"; },
                  TypeError);
     assertThrows(pill, TypeError);
-    assertEquals(pill.prototype, (function(){}).prototype);
-    var d = Object.getOwnPropertyDescriptor(pill, "prototype");
-    assertFalse(d.writable);
-    assertFalse(d.configurable);
-    assertFalse(d.enumerable);
+    assertEquals(undefined, pill.prototype);
   }
 
   var descriptor = Object.getOwnPropertyDescriptor(func, name);