[regexp] Fix RegExp.prototype.toString.

test/mjsunit/es6/regexp-tostring.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var log = [];
 
 var fake =
     {
-      pattern: function() {
+      get source() {
         log.push("p");
         return {
           toString: function() {
             log.push("ps");
             return "pattern";
           }
         };
       },
-      flags: function() {
+      get flags() {
         log.push("f");
         return {
           toString: function() {
             log.push("fs");
             return "flags";
           }
         };
       }
     }
 
 function testThrows(x) {
   try {
     RegExp.prototype.toString.call(x);
   } catch (e) {
     assertTrue(/incompatible receiver/.test(e.message));
     return;
   }
   assertUnreachable();
 }
 
 testThrows(1);
 testThrows(null);
-Number.prototype.pattern = () => "a";
-Number.prototype.flags = () => "b";
+Number.prototype.source = "a";
+Number.prototype.flags = "b";
 testThrows(1);
 
 assertEquals("/pattern/flags", RegExp.prototype.toString.call(fake));
 assertEquals(["p", "ps", "f", "fs"], log);