[regexp] Fix RegExp.prototype.toString.

Initial fix was simply wrong.

R=verwaest@chromium.org
BUG=v8:4524
LOG=N

Review URL: https://codereview.chromium.org/1688163003

Cr-Commit-Position: refs/heads/master@{#33896}
diff --git a/src/js/regexp.js b/src/js/regexp.js
index f4c6f8a..9f2a168 100644
--- a/src/js/regexp.js
+++ b/src/js/regexp.js
@@ -282,7 +282,7 @@
       throw MakeTypeError(
           kIncompatibleMethodReceiver, 'RegExp.prototype.toString', this);
     }
-    return '/' + TO_STRING(this.pattern()) + '/' + TO_STRING(this.flags());
+    return '/' + TO_STRING(this.source) + '/' + TO_STRING(this.flags);
   }
   var result = '/' + REGEXP_SOURCE(this) + '/';
   if (REGEXP_GLOBAL(this)) result += 'g';
diff --git a/test/mjsunit/es6/regexp-tostring.js b/test/mjsunit/es6/regexp-tostring.js
index 8e6857e..3deeeb7 100644
--- a/test/mjsunit/es6/regexp-tostring.js
+++ b/test/mjsunit/es6/regexp-tostring.js
@@ -6,7 +6,7 @@
 
 var fake =
     {
-      pattern: function() {
+      get source() {
         log.push("p");
         return {
           toString: function() {
@@ -15,7 +15,7 @@
           }
         };
       },
-      flags: function() {
+      get flags() {
         log.push("f");
         return {
           toString: function() {
@@ -38,8 +38,8 @@
 
 testThrows(1);
 testThrows(null);
-Number.prototype.pattern = () => "a";
-Number.prototype.flags = () => "b";
+Number.prototype.source = "a";
+Number.prototype.flags = "b";
 testThrows(1);
 
 assertEquals("/pattern/flags", RegExp.prototype.toString.call(fake));
diff --git a/test/mjsunit/regexp.js b/test/mjsunit/regexp.js
index b6f019e..1a5de2a 100644
--- a/test/mjsunit/regexp.js
+++ b/test/mjsunit/regexp.js
@@ -719,9 +719,6 @@
 assertThrows("RegExp.prototype.toString.call('')", TypeError);
 assertThrows("RegExp.prototype.toString.call(false)", TypeError);
 assertThrows("RegExp.prototype.toString.call(true)", TypeError);
-assertThrows("RegExp.prototype.toString.call([])", TypeError);
-assertThrows("RegExp.prototype.toString.call({})", TypeError);
-assertThrows("RegExp.prototype.toString.call(function(){})", TypeError);
 
 // Test mutually recursive capture and backreferences.
 assertEquals(["b", "", ""], /(\2)b(\1)/.exec("aba"));