[regexp] Don't cache exec method in Regexp.proto[@@split]

The call to RegExpSubclassExec may refer to a different exec method
since splitter is newly constructed previously to the call.

BUG=v8:5351

Review-Url: https://codereview.chromium.org/2370733003
Cr-Commit-Position: refs/heads/master@{#39774}

src/js/regexp.js

@@ -344,9 +344,8 @@ function RegExpSubclassSplit(string, limit) {
 
   // TODO(adamk): this fast path is wrong as we doesn't ensure that 'exec'
   // is actually a data property on RegExp.prototype.
-  var exec;
   if (IS_REGEXP(this) && constructor === GlobalRegExp) {
-    exec = this.exec;
+    var exec = this.exec;
     if (exec === RegExpExecJS) {
       return %_Call(RegExpSplit, this, string, limit);
     }
@@ -371,9 +370,7 @@ function RegExpSubclassSplit(string, limit) {
   var stringIndex = prevStringIndex;
   while (stringIndex < size) {
     splitter.lastIndex = stringIndex;
-    result = RegExpSubclassExec(splitter, string, exec);
-    // Ensure exec will be read again on the next loop through.
-    exec = UNDEFINED;
+    result = RegExpSubclassExec(splitter, string);
     if (IS_NULL(result)) {
       stringIndex += AdvanceStringIndex(string, stringIndex, unicode);
     } else {

test/mjsunit/regress/regress-5351.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var re = /[bc]/;
+var str = "baba";
+
+assertEquals(["", "a", "a"], str.split(re));
+
+// Force slow path.
+re.exec = (string) => RegExp.prototype.exec.call(re, string);
+assertEquals(["", "a", "a"], str.split(re));