Use instance type in Object.prototype.toString().

test/cctest/test-inobject-slack-tracking.cc

Index: test/cctest/test-inobject-slack-tracking.cc
diff --git a/test/cctest/test-inobject-slack-tracking.cc b/test/cctest/test-inobject-slack-tracking.cc
index 0a13dc716c90788ff3b3b8c053b5f35b580454a3..9f33d5593858cd8cb14f6aaf1520078b592760e2 100644
--- a/test/cctest/test-inobject-slack-tracking.cc
+++ b/test/cctest/test-inobject-slack-tracking.cc
@@ -925,15 +925,14 @@ TEST(SubclassErrorBuiltin) {
   v8::HandleScope scope(CcTest::isolate());
 
   const int first_field = 2;
-  TestSubclassBuiltin("A1", JS_OBJECT_TYPE, "Error", "'err'", first_field);
-  TestSubclassBuiltin("A2", JS_OBJECT_TYPE, "EvalError", "'err'", first_field);
-  TestSubclassBuiltin("A3", JS_OBJECT_TYPE, "RangeError", "'err'", first_field);
-  TestSubclassBuiltin("A4", JS_OBJECT_TYPE, "ReferenceError", "'err'",
+  TestSubclassBuiltin("A1", JS_ERROR_TYPE, "Error", "'err'", first_field);
+  TestSubclassBuiltin("A2", JS_ERROR_TYPE, "EvalError", "'err'", first_field);
+  TestSubclassBuiltin("A3", JS_ERROR_TYPE, "RangeError", "'err'", first_field);
+  TestSubclassBuiltin("A4", JS_ERROR_TYPE, "ReferenceError", "'err'",
                       first_field);
-  TestSubclassBuiltin("A5", JS_OBJECT_TYPE, "SyntaxError", "'err'",
-                      first_field);
-  TestSubclassBuiltin("A6", JS_OBJECT_TYPE, "TypeError", "'err'", first_field);
-  TestSubclassBuiltin("A7", JS_OBJECT_TYPE, "URIError", "'err'", first_field);
+  TestSubclassBuiltin("A5", JS_ERROR_TYPE, "SyntaxError", "'err'", first_field);
+  TestSubclassBuiltin("A6", JS_ERROR_TYPE, "TypeError", "'err'", first_field);
+  TestSubclassBuiltin("A7", JS_ERROR_TYPE, "URIError", "'err'", first_field);
 }