[regexp] Add fuzzing for JSRegExpResultIndices to regexp-builtins

When regexp match indices are enabled, we stash required data in the JSRegExpResult object,
and then build a JSRegExpResultIndices object lazily when the 'indices' property is
accessed.

This cl simply checks that fast and slow paths produce the same values for
result.indices and result.indices.groups.

Change-Id: I6322d8eaef4c6e5a0ed3a5aef8b2ff05ac2b2c7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763249Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63301}

test/fuzzer/regexp-builtins.cc

@@ -337,8 +337,14 @@ bool ResultsAreIdentical(FuzzerArgs* args) {
   std::string source =
       "assertEquals(fast.exception, slow.exception);\n"
       "assertEquals(fast.result, slow.result);\n"
-      "if (fast.result !== null)\n"
+      "if (fast.result !== null) {\n"
       "  assertEquals(fast.result.groups, slow.result.groups);\n"
+      "  assertEquals(fast.results.indices, slow.result.indices;\n"
+      "  if (fast.result.indices !== null) {\n"
+      "    assertEquals(fast.result.indices.groups,\n"
+      "                 slow.result.indices.groups);\n"
+      "  }\n"
+      "}\n"
       "assertEquals(fast.re.lastIndex, slow.re.lastIndex);\n";
 
   v8::Local<v8::Value> result;