[regexp] Fix RegExp.prototype.toString.

Initial fix was simply wrong.

R=verwaest@chromium.org
BUG=v8:4524
LOG=N

Review URL: https://codereview.chromium.org/1688163003

Cr-Commit-Position: refs/heads/master@{#33896}

src/js/regexp.js

@@ -282,7 +282,7 @@ function RegExpToString() {
       throw MakeTypeError(
           kIncompatibleMethodReceiver, 'RegExp.prototype.toString', this);
     }
-    return '/' + TO_STRING(this.pattern()) + '/' + TO_STRING(this.flags());
+    return '/' + TO_STRING(this.source) + '/' + TO_STRING(this.flags);
   }
   var result = '/' + REGEXP_SOURCE(this) + '/';
   if (REGEXP_GLOBAL(this)) result += 'g';

test/mjsunit/es6/regexp-tostring.js

@@ -6,7 +6,7 @@ var log = [];
 
 var fake =
     {
-      pattern: function() {
+      get source() {
         log.push("p");
         return {
           toString: function() {
@@ -15,7 +15,7 @@ var fake =
           }
         };
       },
-      flags: function() {
+      get flags() {
         log.push("f");
         return {
           toString: function() {
@@ -38,8 +38,8 @@ function testThrows(x) {
 
 testThrows(1);
 testThrows(null);
-Number.prototype.pattern = () => "a";
-Number.prototype.flags = () => "b";
+Number.prototype.source = "a";
+Number.prototype.flags = "b";
 testThrows(1);
 
 assertEquals("/pattern/flags", RegExp.prototype.toString.call(fake));

test/mjsunit/regexp.js

@@ -719,9 +719,6 @@ assertThrows("RegExp.prototype.toString.call(0)", TypeError);
 assertThrows("RegExp.prototype.toString.call('')", TypeError);
 assertThrows("RegExp.prototype.toString.call(false)", TypeError);
 assertThrows("RegExp.prototype.toString.call(true)", TypeError);
-assertThrows("RegExp.prototype.toString.call([])", TypeError);
-assertThrows("RegExp.prototype.toString.call({})", TypeError);
-assertThrows("RegExp.prototype.toString.call(function(){})", TypeError);
 
 // Test mutually recursive capture and backreferences.
 assertEquals(["b", "", ""], /(\2)b(\1)/.exec("aba"));