Fix use of non-gc safe pointer in regexp code.

Review URL: http://codereview.chromium.org/8034002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/runtime.cc

@@ -2953,7 +2953,7 @@ MUST_USE_RESULT static MaybeObject* StringReplaceRegExpWithString(
 
   // Shortcut for simple non-regexp global replacements
   if (is_global &&
-      regexp->TypeTag() == JSRegExp::ATOM &&
+      regexp_handle->TypeTag() == JSRegExp::ATOM &&
       compiled_replacement.simple_hint()) {
     if (subject_handle->HasOnlyAsciiChars() &&
         replacement_handle->HasOnlyAsciiChars()) {