Fix regex regression in top-of-tree.

R=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/8896001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -8372,7 +8372,7 @@ MaybeObject* JSArray::Initialize(int capacity) {
 
 void JSArray::Expand(int required_size) {
   GetIsolate()->factory()->SetElementsCapacityAndLength(
-      Handle<JSArray>(this), required_size, Smi::cast(length())->value());
+      Handle<JSArray>(this), required_size, required_size);
 }