Turn message property of the error object into a data property.

test/mjsunit/harmony/proxies.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 631 matching lines @@
   assertFalse(Object.prototype.hasOwnProperty.call(o, "p_throw"));
 
   assertThrows(function(){ o.p_setterthrow = 52 }, "myexn")
   assertEquals("p_setterthrow", key)
   assertFalse(Object.prototype.hasOwnProperty.call(o, "p_setterthrow"));
 }
 
 
 TestSetForDerived(
   function(k) {
+    // TODO(yangguo): issue 2398 - throwing an error causes formatting of
+    // the message string, which can be observable through this handler.
+    // We ignore keys that occur when formatting the message string.
+    if (k == "toString" || k == "valueOf") return;
+
     key = k;
     switch (k) {
       case "p_writable": return {writable: true, configurable: true}
       case "p_nonwritable": return {writable: false, configurable: true}
       case "p_setter": return {
         set: function(x) { rec = this; val = x },
         configurable: true
       }
       case "p_nosetter": return {
         get: function() { return 1 },
@@ skipping 1625 matching lines @@
 function TestConstructorWithProxyPrototype2(create, handler) {
   function C() {};
   C.prototype = create(handler);
 
   var o = new C;
   assertSame(C.prototype, o.__proto__);
   assertSame(C.prototype, Object.getPrototypeOf(o));
 }
 
 TestConstructorWithProxyPrototype();