Change TF regression test to not trigger tons of allocation

Instead of allocating an ArrayBuffer in the test, use a different example
from the original bug.

R=bmeurer@chromium.org
BUG=chromium:644631, v8:5504

Review-Url: https://codereview.chromium.org/2408403002
Cr-Commit-Position: refs/heads/master@{#40195}

test/mjsunit/regress/regress-crbug-644631.js

@@ -2,11 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --turbo --always-opt
+// Flags: --allow-natives-syntax --turbo --always-opt
 
 function f() {
-  new Int8Array(new ArrayBuffer(2147483648));
+  var obj = Object.freeze({});
+  %_CreateDataProperty(obj, "foo", "bar");
 }
 
 // Should not crash
-assertThrows(f, RangeError);
+assertThrows(f, TypeError);