[regexp] Fix tier-up logic

Commit 213504b9 broke tier-up for
regular expressions (Tier-up didn't trigger anymore).
This CL fixes this issue.

Bug: v8:9516,v8:9566
Change-Id: I76971bc4375f9885e58988eca92be217ddd4d924
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778291
Auto-Submit: Patrick Thier <pthier@google.com>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63480}

src/builtins/builtins-regexp-gen.cc

@@ -516,8 +516,8 @@ TNode<HeapObject> RegExpBuiltinsAssembler::RegExpExecInternal(
   // Tier-up in runtime if ticks are non-zero and tier-up hasn't happened yet
   // and ensure that a RegExp stack is allocated when using compiled Irregexp.
   {
-    Label next(this);
-    GotoIfNot(TaggedIsSmi(var_bytecode.value()), &next);
+    Label next(this), check_tier_up(this);
+    GotoIfNot(TaggedIsSmi(var_bytecode.value()), &check_tier_up);
     CSA_ASSERT(this, SmiEqual(CAST(var_bytecode.value()),
                               SmiConstant(JSRegExp::kUninitializedValue)));
 
@@ -525,8 +525,10 @@ TNode<HeapObject> RegExpBuiltinsAssembler::RegExpExecInternal(
     TNode<IntPtrT> stack_size = UncheckedCast<IntPtrT>(
         Load(MachineType::IntPtr(), regexp_stack_memory_size_address));
     GotoIf(IntPtrEqual(stack_size, IntPtrZero()), &runtime);
+    Goto(&next);
 
     // Check if tier-up is requested.
+    BIND(&check_tier_up);
     TNode<Smi> ticks = CAST(
         UnsafeLoadFixedArrayElement(data, JSRegExp::kIrregexpTierUpTicksIndex));
     GotoIf(SmiToInt32(ticks), &runtime);