Revert "In RegExp, lastIndex is read with ToLength, not ToInteger"

$toLength is slow, causing a 3.8%-8% regression in the Octane RegExp
benchmark. Reverting this patch brings it back up. To make this change,
we'll need a faster implementation fo $toLength.

BUG=chromium:513160
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1243053005

Cr-Commit-Position: refs/heads/master@{#29830}

src/regexp.js

@@ -154,9 +154,9 @@ function RegExpExecJS(string) {
   string = TO_STRING_INLINE(string);
   var lastIndex = this.lastIndex;
 
-  // Conversion is required by the ES6 specification (RegExpBuiltinExec
-  // algorithm, step 4) even if the value is discarded for non-global RegExps.
-  var i = $toLength(lastIndex);
+  // Conversion is required by the ES5 specification (RegExp.prototype.exec
+  // algorithm, step 5) even if the value is discarded for non-global RegExps.
+  var i = TO_INTEGER(lastIndex);
 
   var updateLastIndex = this.global || (harmony_regexps && this.sticky);
   if (updateLastIndex) {
@@ -202,9 +202,9 @@ function RegExpTest(string) {
 
   var lastIndex = this.lastIndex;
 
-  // Conversion is required by the ES6 specification (RegExpBuiltinExec
-  // algorithm, step 4) even if the value is discarded for non-global RegExps.
-  var i = $toLength(lastIndex);
+  // Conversion is required by the ES5 specification (RegExp.prototype.exec
+  // algorithm, step 5) even if the value is discarded for non-global RegExps.
+  var i = TO_INTEGER(lastIndex);
 
   if (this.global || (harmony_regexps && this.sticky)) {
     if (i < 0 || i > string.length) {

test/mozilla/mozilla.status

@@ -85,8 +85,6 @@
   'ecma/String/15.5.4.8-1': [FAIL],
   'ecma/String/15.5.4.9-1': [FAIL],
 
-  # ToLength, not ToUint32, is called on RegExps' lastIndex property
-  'ecma_3/RegExp/15.10.6.2-2': [FAIL],
 
   ##################### SKIPPED TESTS #####################
 

test/test262-es6/test262-es6.status

@@ -421,6 +421,9 @@
   # https://code.google.com/p/v8/issues/detail?id=4003
   'built-ins/RegExp/prototype/15.10.6': [FAIL],
 
+  # https://code.google.com/p/v8/issues/detail?id=4244
+  'built-ins/RegExp/prototype/exec/S15.10.6.2_A5_T3': [FAIL],
+
   # https://code.google.com/p/v8/issues/detail?id=4006
   'built-ins/String/prototype/S15.5.4_A1': [FAIL],
   'built-ins/String/prototype/S15.5.4_A2': [FAIL],

test/test262/test262.status

@@ -281,9 +281,6 @@
   '15.2.3.13-1-3': [FAIL],
   '15.2.3.13-1-4': [FAIL],
 
-  # ES6 RegExp test calls ToLength, not ToUint32
-  'S15.10.6.2_A5_T3': [FAIL],
-
   ######################## NEEDS INVESTIGATION ###########################
 
   # These test failures are specific to the intl402 suite and need investigation