Fix another message object leak.

test/cctest/test-api.cc

Index: test/cctest/test-api.cc
diff --git a/test/cctest/test-api.cc b/test/cctest/test-api.cc
index 90f499674299768599b7986e8674a487fe54c10f..48dc72e7b3d8fc1159ccbb294cffed54996081ef 100644
--- a/test/cctest/test-api.cc
+++ b/test/cctest/test-api.cc
@@ -2389,6 +2389,11 @@ TEST(APIThrowMessageOverwrittenToString) {
   CompileRun("asdf;");
   v8::Handle<Value> string = CompileRun("try { asdf; } catch(e) { e + ''; }");
   CHECK(string->Equals(v8_str("Whoops")));
+  CompileRun("ReferenceError.prototype.constructor = new Object();"
+             "ReferenceError.prototype.constructor.name = 1;"
+             "Number.prototype.toString = function() { return 'Whoops'; };"
+             "ReferenceError.prototype.toString = Object.prototype.toString;");
+  CompileRun("asdf;");
   v8::V8::RemoveMessageListeners(check_message);
 }