Fix perf regression in RegExp/Match

Existing Torque code uses bounds-checked access and it seems to hurt
perf. Change to use UnsafeLoadFixedArrayElement.

Bug: chromium:1028605
Change-Id: Ifcf3b9d181b4ec0ed1b757eeed466b0f76808578
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2007894
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65869}

src/builtins/regexp-match.tq

@@ -16,6 +16,9 @@ namespace regexp {
   extern transitioning macro RegExpBuiltinsAssembler::FlagGetter(
       implicit context: Context)(Object, constexpr Flag, constexpr bool): bool;
 
+  extern macro UnsafeLoadFixedArrayElement(RegExpMatchInfo, constexpr int31):
+      Object;
+
   transitioning macro RegExpPrototypeMatchBody(implicit context: Context)(
       regexp: JSReceiver, string: String, isFastPath: constexpr bool): JSAny {
     if constexpr (isFastPath) {
@@ -63,9 +66,12 @@ namespace regexp {
           if (atom) {
             match = searchString;
           } else {
-            const matchFrom: Smi = matchIndices.GetStartOfCapture(0);
-            const matchTo: Smi = matchIndices.GetEndOfCapture(0);
-            match = SubString(string, matchFrom, matchTo);
+            const matchFrom = UnsafeLoadFixedArrayElement(
+                matchIndices, kRegExpMatchInfoFirstCaptureIndex);
+            const matchTo = UnsafeLoadFixedArrayElement(
+                matchIndices, kRegExpMatchInfoFirstCaptureIndex + 1);
+            match = SubString(
+                string, UnsafeCast<Smi>(matchFrom), UnsafeCast<Smi>(matchTo));
           }
         } else {
           assert(!isFastPath);