[mjsunit] fix regression test for v8:7706

The originally checked in regression test (https://chromium-review.googlesource.com/c/v8/v8/+/1034210/3/test/mjsunit/es6/regress/regress-7706.js)
didn't actually reproduce the bug.

BUG=v8:7706
R=gsathya@chromium.org, bmeurer@chromium.org

Change-Id: I991c91d5a7f15419e388cb5133a281cf7f51736a
Reviewed-on: https://chromium-review.googlesource.com/1036108Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#52894}

test/mjsunit/es6/regress/regress-7706.js

@@ -7,7 +7,10 @@
 class Test extends Number {}
 Test.prototype[Symbol.toStringTag] = "Test";
 
-assertEquals("[object Test]", Object.prototype.toString.call(new Test));
+function toString(o) {
+  %ToFastProperties(o.__proto__);
+  return Object.prototype.toString.call(o);
+}
 
-%ToFastProperties(Test.prototype);
-assertEquals("[object Test]", Object.prototype.toString.call(new Test));
+assertEquals("[object Test]", toString(new Test), "Try #1");
+assertEquals("[object Test]", toString(new Test), "Try #2");