Revert of Revert "In RegExp, lastIndex is read with ToLength, not ToInteger"...

Revert of Revert "In RegExp, lastIndex is read with ToLength, not ToInteger" (patchset #1 id:1 of https://codereview.chromium.org/1243053005/)

Reason for revert:
[Sheriff] This causes a breakage with custom snapshot (bisected locally):
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/1190

Original issue's description:
> Revert "In RegExp, lastIndex is read with ToLength, not ToInteger"
>
> $toLength is slow, causing a 3.8%-8% regression in the Octane RegExp
> benchmark. Reverting this patch brings it back up. To make this change,
> we'll need a faster implementation fo $toLength.
>
> BUG=chromium:513160
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/477d651c6a978bdf34954048a235895c62dab0ac
> Cr-Commit-Position: refs/heads/master@{#29830}

TBR=adamk@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:513160

Review URL: https://codereview.chromium.org/1254723005

Cr-Commit-Position: refs/heads/master@{#29835}

src/regexp.js

@@ -154,9 +154,9 @@ function RegExpExecJS(string) {
   string = TO_STRING_INLINE(string);
   var lastIndex = this.lastIndex;
 
-  // Conversion is required by the ES5 specification (RegExp.prototype.exec
-  // algorithm, step 5) even if the value is discarded for non-global RegExps.
-  var i = TO_INTEGER(lastIndex);
+  // Conversion is required by the ES6 specification (RegExpBuiltinExec
+  // algorithm, step 4) even if the value is discarded for non-global RegExps.
+  var i = $toLength(lastIndex);
 
   var updateLastIndex = this.global || (harmony_regexps && this.sticky);
   if (updateLastIndex) {
@@ -202,9 +202,9 @@ function RegExpTest(string) {
 
   var lastIndex = this.lastIndex;
 
-  // Conversion is required by the ES5 specification (RegExp.prototype.exec
-  // algorithm, step 5) even if the value is discarded for non-global RegExps.
-  var i = TO_INTEGER(lastIndex);
+  // Conversion is required by the ES6 specification (RegExpBuiltinExec
+  // algorithm, step 4) even if the value is discarded for non-global RegExps.
+  var i = $toLength(lastIndex);
 
   if (this.global || (harmony_regexps && this.sticky)) {
     if (i < 0 || i > string.length) {

test/mozilla/mozilla.status

@@ -85,6 +85,8 @@
   'ecma/String/15.5.4.8-1': [FAIL],
   'ecma/String/15.5.4.9-1': [FAIL],
 
+  # ToLength, not ToUint32, is called on RegExps' lastIndex property
+  'ecma_3/RegExp/15.10.6.2-2': [FAIL],
 
   ##################### SKIPPED TESTS #####################
 

test/test262-es6/test262-es6.status

@@ -421,9 +421,6 @@
   # https://code.google.com/p/v8/issues/detail?id=4003
   'built-ins/RegExp/prototype/15.10.6': [FAIL],
 
-  # https://code.google.com/p/v8/issues/detail?id=4244
-  'built-ins/RegExp/prototype/exec/S15.10.6.2_A5_T3': [FAIL],
-
   # https://code.google.com/p/v8/issues/detail?id=4006
   'built-ins/String/prototype/S15.5.4_A1': [FAIL],
   'built-ins/String/prototype/S15.5.4_A2': [FAIL],

test/test262/test262.status

@@ -281,6 +281,9 @@
   '15.2.3.13-1-3': [FAIL],
   '15.2.3.13-1-4': [FAIL],
 
+  # ES6 RegExp test calls ToLength, not ToUint32
+  'S15.10.6.2_A5_T3': [FAIL],
+
   ######################## NEEDS INVESTIGATION ###########################
 
   # These test failures are specific to the intl402 suite and need investigation