[regexp] fix subtle bug in RegExpTest.

src/js/regexp.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 'use strict';
 
 %CheckIsBootstrapping();
 
@@ skipping 307 matching lines @@
     }
     this.lastIndex = RegExpLastMatchInfo[CAPTURE1];
     return true;
   } else {
     // Non-global, non-sticky regexp.
     // Remove irrelevant preceeding '.*' in a test regexp.  The expression
     // checks whether this.source starts with '.*' and that the third char is
     // not a '?'.  But see https://code.google.com/p/v8/issues/detail?id=3560
     var regexp = this;
     var source = REGEXP_SOURCE(regexp);
-    if (regexp.length >= 3 &&
-        %_StringCharCodeAt(regexp, 0) == 46 &&  // '.'
-        %_StringCharCodeAt(regexp, 1) == 42 &&  // '*'
-        %_StringCharCodeAt(regexp, 2) != 63) {  // '?'
+    if (source.length >= 3 &&
+        %_StringCharCodeAt(source, 0) == 46 &&  // '.'
+        %_StringCharCodeAt(source, 1) == 42 &&  // '*'
+        %_StringCharCodeAt(source, 2) != 63) {  // '?'
       regexp = TrimRegExp(regexp);
     }
     // matchIndices is either null or the RegExpLastMatchInfo array.
     var matchIndices = %_RegExpExec(regexp, string, 0, RegExpLastMatchInfo);
     if (IS_NULL(matchIndices)) {
       this.lastIndex = 0;
       return false;
     }
     return true;
   }
@@ skipping 895 matching lines @@
   to.RegExpSubclassExecJS = RegExpSubclassExecJS;
   to.RegExpSubclassMatch = RegExpSubclassMatch;
   to.RegExpSubclassReplace = RegExpSubclassReplace;
   to.RegExpSubclassSearch = RegExpSubclassSearch;
   to.RegExpSubclassSplit = RegExpSubclassSplit;
   to.RegExpSubclassTest = RegExpSubclassTest;
   to.RegExpTest = RegExpTest;
 });
 
 })