This CL adds a TFS stub for RegExp#test and moves several checks to
the JSCallReducer. In particular, the JSCallReducer checks that
 - property {exec} on the regexp is still the original exec
 - property {lastIndex} on the regexp is a non-negative smi
The stub does not repeat these checks in release mode.

This effectively means that if the regexp is known, we can perform these
checks at compile time, and get away with a map dependency.

Bug: v8:7779, v8:7200

Change-Id: I0c6d711d4f1d2f6f325a1c02855b0e1b62e014c8
Reviewed-on: https://chromium-review.googlesource.com/1074654
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53630}