Stop using plain Arrays internally in built-in functions.

src/regexp.js

Index: src/regexp.js
diff --git a/src/regexp.js b/src/regexp.js
index 5b7e3a9d2f80563889c95d9b04b8306c4bb7936d..f68dee6135471f1bc2e909c524e183a6a8922497 100644
--- a/src/regexp.js
+++ b/src/regexp.js
@@ -384,13 +384,13 @@ function RegExpMakeCaptureGetter(n) {
 // pairs for the match and all the captured substrings), the invariant is
 // that there are at least two capture indeces.  The array also contains
 // the subject string for the last successful match.
-var lastMatchInfo = [
+var lastMatchInfo = new InternalArray(
     2,                 // REGEXP_NUMBER_OF_CAPTURES
     "",                // Last subject.
     void 0,            // Last input - settable with RegExpSetInput.
     0,                 // REGEXP_FIRST_CAPTURE + 0
-    0,                 // REGEXP_FIRST_CAPTURE + 1
-];
+    0                  // REGEXP_FIRST_CAPTURE + 1
+);
 
 // Override last match info with an array of actual substrings.
 // Used internally by replace regexp with function.