Change TF regression test to not trigger tons of allocation

test/mjsunit/regress/regress-crbug-644631.js

Index: test/mjsunit/regress/regress-crbug-644631.js
diff --git a/test/mjsunit/regress/regress-crbug-644631.js b/test/mjsunit/regress/regress-crbug-644631.js
index 5e649a49463791f960bc635f207c3ab69d3b2169..bf845c7aeed7790b296f38daee8e3206064ebe12 100644
--- a/test/mjsunit/regress/regress-crbug-644631.js
+++ b/test/mjsunit/regress/regress-crbug-644631.js
@@ -2,11 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --turbo --always-opt
+// Flags: --allow-natives-syntax --turbo --always-opt
 
 function f() {
-  new Int8Array(new ArrayBuffer(2147483648));
+  var obj = Object.freeze({});
+  %_CreateDataProperty(obj, "foo", "bar");
 }
 
 // Should not crash
-assertThrows(f, RangeError);
+assertThrows(f, TypeError);