Make sure error message formatting does not have side effects.

R=vegorov@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11598011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/messages.js

@@ -192,7 +192,7 @@ function NoSideEffectToString(obj) {
   if (IS_NULL(obj)) return 'null';
   if (IS_FUNCTION(obj)) return  %_CallFunction(obj, FunctionToString);
   if (IS_OBJECT(obj) && %GetDataProperty(obj, "toString") === ObjectToString) {
-    var constructor = obj.constructor;
+    var constructor = %GetDataProperty(obj, "constructor");
     if (typeof constructor == "function") {
       var constructorName = constructor.name;
       if (IS_STRING(constructorName) && constructorName !== "") {

test/mjsunit/error-tostring.js

@@ -83,3 +83,11 @@ assertEquals(["Error: e2",[1,3,4]], testErrorToString(undefined, "e2"));
 assertEquals(["null: e2",[1,2,3,4]], testErrorToString(null, "e2"));
 assertEquals(["e2",[1,2,3,4]], testErrorToString("", "e2"));
 assertEquals(["e1: e2",[1,2,3,4]], testErrorToString("e1", "e2"));
+
+var obj = {
+  get constructor () {
+    assertUnreachable();
+  }
+};
+
+assertThrows(function() { obj.x(); });