[regexp] Fix Smi truncation preventing tier-up

Fix tier-up issue where we would continue to execute bytecode instead of
tiering-up on x64. The problem was that the smi value is stored in upper
32 bits which would get truncated, so we were checking the wrong value.

Change-Id: I609b56ad58621c6ab7642d0ce453563ce09ae097
Bug: v8:9566
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773269
Commit-Queue: Ana Pesko <anapesko@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63440}

src/builtins/builtins-regexp-gen.cc

@@ -560,7 +560,7 @@ TNode<HeapObject> RegExpBuiltinsAssembler::RegExpExecInternal(
     // Tier-up in runtime to compiler if ticks are non-zero.
     TNode<Smi> ticks = CAST(
         UnsafeLoadFixedArrayElement(data, JSRegExp::kIrregexpTierUpTicksIndex));
-    GotoIf(TruncateIntPtrToInt32(BitcastTaggedSignedToWord(ticks)), &runtime);
+    GotoIf(SmiToInt32(ticks), &runtime);
 
     IncrementCounter(isolate()->counters()->regexp_entry_native(), 1);