[regexp] Fix fallback path in RegExpExec

This fixes the code-path in RegExpExec in which both the passed exec
argument and regexp.exec are not callable and regexp is a JSRegExp.

In this case, we fall back to the default RegExp.prototype.exec
implementation. The arguments for Execution::call were incorrect.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2415073002
Cr-Commit-Position: refs/heads/master@{#40249}

src/regexp/regexp-utils.cc

@@ -154,7 +154,7 @@ MaybeHandle<Object> RegExpUtils::RegExpExec(Isolate* isolate,
     ScopedVector<Handle<Object>> argv(argc);
     argv[0] = string;
 
-    return Execution::Call(isolate, exec, regexp_exec, argc, argv.start());
+    return Execution::Call(isolate, regexp_exec, regexp, argc, argv.start());
   }
 }
 

test/mjsunit/regexp-regexpexec.js

@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that the fallback path in RegExpExec executes the default exec
+// implementation.
+delete RegExp.prototype.exec;
+assertEquals("b", "aba".replace(/a/g, ""));