Use in-object fields instead of private symbols for regexp slots.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 6986d00cd7e26e2a0604f8040d68e45f6ce654c9..c2421d019efcf51a71de4167346edb0f305fda2c 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -7725,6 +7725,8 @@ class JSRegExp: public JSObject {
   };
 
   DECL_ACCESSORS(data, Object)
+  DECL_ACCESSORS(flags, Object)
+  DECL_ACCESSORS(source, Object)
 
   inline Type TypeTag();
   inline int CaptureCount();
@@ -7757,7 +7759,9 @@ class JSRegExp: public JSObject {
   DECLARE_VERIFIER(JSRegExp)
 
   static const int kDataOffset = JSObject::kHeaderSize;
-  static const int kSize = kDataOffset + kPointerSize;
+  static const int kSourceOffset = kDataOffset + kPointerSize;
+  static const int kFlagsOffset = kSourceOffset + kPointerSize;
+  static const int kSize = kFlagsOffset + kPointerSize;
 
   // Indices in the data array.
   static const int kTagIndex = 0;
@@ -7806,10 +7810,8 @@ class JSRegExp: public JSObject {
       FixedArray::kHeaderSize + kIrregexpCaptureCountIndex * kPointerSize;
 
   // In-object fields.
-  static const int kSourceFieldIndex = 0;
-  static const int kFlagsFieldIndex = 1;
-  static const int kLastIndexFieldIndex = 2;
-  static const int kInObjectFieldCount = 3;
+  static const int kLastIndexFieldIndex = 0;
+  static const int kInObjectFieldCount = 1;
 
   // The uninitialized value for a regexp code object.
   static const int kUninitializedValue = -1;