Use in-object fields instead of private symbols for regexp slots.

src/crankshaft/hydrogen-instructions.h

Index: src/crankshaft/hydrogen-instructions.h
diff --git a/src/crankshaft/hydrogen-instructions.h b/src/crankshaft/hydrogen-instructions.h
index 050c771d2c07feccd217c0ed15277d1b57c8ea44..579379e7b74ac72dce5fb6ad7c25696ddfbe94d7 100644
--- a/src/crankshaft/hydrogen-instructions.h
+++ b/src/crankshaft/hydrogen-instructions.h
@@ -2883,9 +2883,10 @@ class HCheckInstanceType final : public HUnaryOperation {
     IS_SPEC_OBJECT,
     IS_JS_ARRAY,
     IS_JS_DATE,
+    IS_JS_REGEXP,

[Benedikt Meurer, 2015/11/04 14:02:40]

Undo these changes.

     IS_STRING,
     IS_INTERNALIZED_STRING,
-    LAST_INTERVAL_CHECK = IS_JS_DATE
+    LAST_INTERVAL_CHECK = IS_JS_REGEXP
   };
 
   DECLARE_INSTRUCTION_FACTORY_P2(HCheckInstanceType, HValue*, Check);
@@ -2900,8 +2901,8 @@ class HCheckInstanceType final : public HUnaryOperation {
     switch (check_) {
       case IS_SPEC_OBJECT: return HType::JSObject();
       case IS_JS_ARRAY: return HType::JSArray();
-      case IS_JS_DATE:
-        return HType::JSObject();
+      case IS_JS_DATE: return HType::JSObject();
+      case IS_JS_REGEXP: return HType::JSObject();
       case IS_STRING: return HType::String();
       case IS_INTERNALIZED_STRING: return HType::String();
     }
@@ -6195,6 +6196,10 @@ class HObjectAccess final {
     return HObjectAccess(kInobject, JSGlobalObject::kNativeContextOffset);
   }
 
+  static HObjectAccess ForJSRegExpFlags() {
+    return HObjectAccess(kInobject, JSRegExp::kFlagsOffset);
+  }
+
   static HObjectAccess ForJSCollectionTable() {
     return HObjectAccess::ForObservableJSObjectOffset(
         JSCollection::kTableOffset);