Fix RegExp.prototype.toString for incompatible receivers.

BUG=v8:1981
TEST=mjsunit/regexp

Review URL: https://chromiumcodereview.appspot.com/10426005
Patch from Ioseb Dzmanashvili <ioseb.dzmanashvili@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11637 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/regexp.js

@@ -278,6 +278,10 @@ function TrimRegExp(regexp) {
 
 
 function RegExpToString() {
+  if (!IS_REGEXP(this)) {
+    throw MakeTypeError('incompatible_method_receiver',
+                        ['RegExp.prototype.toString', this]);
+  }
   var result = '/' + this.source + '/';
   if (this.global) result += 'g';
   if (this.ignoreCase) result += 'i';

test/mjsunit/regexp.js

@@ -705,3 +705,14 @@ assertThrows("RegExp('(?!*)')");
 // Test trimmed regular expression for RegExp.test().
 assertTrue(/.*abc/.test("abc"));
 assertFalse(/.*\d+/.test("q"));
+
+// Test that RegExp.prototype.toString() throws TypeError for
+// incompatible receivers (ES5 section 15.10.6 and 15.10.6.4).
+assertThrows("RegExp.prototype.toString.call(null)", TypeError);
+assertThrows("RegExp.prototype.toString.call(0)", TypeError);
+assertThrows("RegExp.prototype.toString.call('')", TypeError);
+assertThrows("RegExp.prototype.toString.call(false)", TypeError);
+assertThrows("RegExp.prototype.toString.call(true)", TypeError);
+assertThrows("RegExp.prototype.toString.call([])", TypeError);
+assertThrows("RegExp.prototype.toString.call({})", TypeError);
+assertThrows("RegExp.prototype.toString.call(function(){})", TypeError);