InstanceOfStub incorrectly interprets the hole as a prototype.

test/mjsunit/regress/regress-crbug-573858.js

Index: test/mjsunit/regress/regress-crbug-573858.js
diff --git a/test/mjsunit/regress/regress-crbug-573858.js b/test/mjsunit/regress/regress-crbug-573858.js
index 37a9eb84e5060cc0c4c70341a58085c15a8bcf42..270df5a64aa9dbb9e6f113b8f6222c9c468b6118 100644
--- a/test/mjsunit/regress/regress-crbug-573858.js
+++ b/test/mjsunit/regress/regress-crbug-573858.js
@@ -9,7 +9,7 @@ var throw_type_error = Object.getOwnPropertyDescriptor(
 
 function create_initial_map() { this instanceof throw_type_error }
 %OptimizeFunctionOnNextCall(create_initial_map);
-create_initial_map();
+assertThrows(create_initial_map);
 
 function test() { new throw_type_error }
 %OptimizeFunctionOnNextCall(test);