Native construction of RegExp result objects, with in-object index and input.

test/mjsunit/fuzz-natives.js

Index: test/mjsunit/fuzz-natives.js
diff --git a/test/mjsunit/fuzz-natives.js b/test/mjsunit/fuzz-natives.js
index a1a5821b373394573461ab769c59e0ca8bb8a5d6..f1c246216b3f8f7dc3d7fd602023ca524c689d98 100644
--- a/test/mjsunit/fuzz-natives.js
+++ b/test/mjsunit/fuzz-natives.js
@@ -163,6 +163,12 @@ var knownProblems = {
   // Performance critical function which cannot afford type checks.
   "_CallFunction": true,
 
+  // Tries to allocate based on argument, and (correctly) throws
+  // out-of-memory if the request is too large. In practice, the
+  // size will be the number of captures of a RegExp.
+  "RegExpConstructResult": true,
+  "_RegExpConstructResult": true,
+
   // LiveEdit feature is under development currently and has fragile input.
   "LiveEditFindSharedFunctionInfosForScript": true,
   "LiveEditGatherCompileInfo": true,