Fix crasher in Object.getOwnPropertySymbols

test/mjsunit/regress/regress-crbug-346141.js

Index: test/mjsunit/regress/regress-crbug-346141.js
diff --git a/test/mjsunit/regress/regress-fast-empty-string.js b/test/mjsunit/regress/regress-crbug-346141.js
similarity index 54%
copy from test/mjsunit/regress/regress-fast-empty-string.js
copy to test/mjsunit/regress/regress-crbug-346141.js
index 9b9fea963a4f7f094283ce5b42289127cb7f594d..798b7704ec2cc0eb928966fdfe9f979d0fe51f94 100644
--- a/test/mjsunit/regress/regress-fast-empty-string.js
+++ b/test/mjsunit/regress/regress-crbug-346141.js
@@ -2,12 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var o = {};
-o[""] = 1;
-var x = {__proto__:o};
-for (i = 0; i < 3; i++) {
-  o[""];
-}
-for (i = 0; i < 3; i++) {
-  assertEquals(undefined, o.x);
-}
+// Flags: --harmony-symbols
+
+var s = Symbol()
+var o = {}
+o[s] = 2
+o[""] = 3
+Object.getOwnPropertySymbols(o)