[runtime] Don't crash when trying to access manually constructed CallSite object.

test/mjsunit/regress/regress-crbug-613905.js

Index: test/mjsunit/regress/regress-crbug-613905.js
diff --git a/test/mjsunit/call-intrinsic-type-error.js b/test/mjsunit/regress/regress-crbug-613905.js
similarity index 57%
copy from test/mjsunit/call-intrinsic-type-error.js
copy to test/mjsunit/regress/regress-crbug-613905.js
index 9d586977d924829f664a34c915440b5c8498dd63..8bb38c9b9d1d0ed119ae29f04334541fcc336313 100644
--- a/test/mjsunit/call-intrinsic-type-error.js
+++ b/test/mjsunit/regress/regress-crbug-613905.js
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+Error.prepareStackTrace = (e,s) => s;
+var CallSiteConstructor = Error().stack[0].constructor;
 
 try {
-  %Call(1, 0);
+  (new CallSiteConstructor(3, 6)).toString();
 } catch (e) {
-  assertTrue(e instanceof TypeError);
 }