Do not coerce lastIndex of a global RegExp in @@match and @@replace.

test/mjsunit/regress/regress-2438.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 17 matching lines @@
 function testSideEffects(subject, re) {
   var counter = 0;
   var side_effect_object = { valueOf: function() { return counter++; } };
   re.lastIndex = side_effect_object;
   re.exec(subject);
   assertEquals(1, counter);
 
   re.lastIndex = side_effect_object;
   re.test(subject);
   assertEquals(2, counter);
-
-  re.lastIndex = side_effect_object;
-  subject.match(re);
-  assertEquals(3, counter);
-
-  re.lastIndex = side_effect_object;
-  subject.replace(re, "");
-  assertEquals(4, counter);
 }
 
 testSideEffects("zzzz", /a/);
 testSideEffects("zzzz", /a/g);
 testSideEffects("xaxa", /a/);
 testSideEffects("xaxa", /a/g);