Fixed RegExp.prototype.toString.call bug not throwing TypeError when non RegExp object was passed.

test/mjsunit/regexp.js

Index: test/mjsunit/regexp.js
diff --git a/test/mjsunit/regexp.js b/test/mjsunit/regexp.js
index ec82c96e094efe1f32e9cf1789bc0ea6e82fc9f2..fe6b7052ab5a94a8ede5eacd3dd2cc5b05f95f8a 100644
--- a/test/mjsunit/regexp.js
+++ b/test/mjsunit/regexp.js
@@ -705,3 +705,13 @@ assertThrows("RegExp('(?!*)')");
 // Test trimmed regular expression for RegExp.test().
 assertTrue(/.*abc/.test("abc"));
 assertFalse(/.*\d+/.test("q"));
+
+// ES5.1, 15.10.6 conformance tests
+assertThrows("RegExp.prototype.toString.call(null)");
+assertThrows("RegExp.prototype.toString.call(0)");
+assertThrows("RegExp.prototype.toString.call('')");
+assertThrows("RegExp.prototype.toString.call(false)");
+assertThrows("RegExp.prototype.toString.call(true)");
+assertThrows("RegExp.prototype.toString.call([])");
+assertThrows("RegExp.prototype.toString.call({})");
+assertThrows("RegExp.prototype.toString.call(function(){})");