Fix Array.prototype.sort for *_STRING_WRAPPER_ELEMENTS

test/mjsunit/regress/regress-crbug-584188.js

Index: test/mjsunit/regress/regress-crbug-584188.js
diff --git a/test/mjsunit/regress/regress-crbug-584188.js b/test/mjsunit/regress/regress-crbug-584188.js
new file mode 100644
index 0000000000000000000000000000000000000000..f54e5593b71ba9ca9736cd9635a6533148a86b1e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-584188.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = {};
+try {
+Object.defineProperty(String.prototype, "3", { x: function() { x = v; }});
+string = "bla";
+} catch(e) {; }
+assertThrows("Array.prototype.sort.call(string);", TypeError);