Correctly load message from an Error object.

test/mjsunit/regress/regress-crbug-306220.js

Index: test/mjsunit/regress/regress-crbug-306220.js
diff --git a/test/mjsunit/regress/regress-crbug-233737.js b/test/mjsunit/regress/regress-crbug-306220.js
similarity index 83%
copy from test/mjsunit/regress/regress-crbug-233737.js
copy to test/mjsunit/regress/regress-crbug-306220.js
index 835726b22429ec3cca68df956255d47c53fcfd25..a481ee9dba111ad7cbbd95fd4ca94a7d8cd2ea56 100644
--- a/test/mjsunit/regress/regress-crbug-233737.js
+++ b/test/mjsunit/regress/regress-crbug-306220.js
@@ -25,18 +25,14 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+var CustomError = function(x) { this.x = x; };
+CustomError.prototype = new Error();
+CustomError.prototype.x = "prototype";
 
-var a = new Array(2);
-a[0] = 1;
-assertTrue(%HasFastSmiElements(a));
-assertTrue(%HasFastHoleyElements(a));
+Object.defineProperties(CustomError.prototype, {
+   'message': {
+      'get': function() { return this.x; }
+   }
+});
 
-function hole(i) {
-  return a[i] << 0;
-}
-
-assertEquals(1, hole(0));
-assertEquals(1, hole(0));
-%OptimizeFunctionOnNextCall(hole);
-assertEquals(0, hole(1));
+assertEquals("Error: instance", String(new CustomError("instance")));