Fix bug in regexp result object construction.

test/mjsunit/regress/regress-regexp-construct-result.js

Index: test/mjsunit/regress/regress-regexp-construct-result.js
diff --git a/test/mjsunit/compiler/osr-with-args.js b/test/mjsunit/regress/regress-regexp-construct-result.js
similarity index 72%
copy from test/mjsunit/compiler/osr-with-args.js
copy to test/mjsunit/regress/regress-regexp-construct-result.js
index 44fa1cb2cf9d0a1fcf3689b03fc01cc4e9f4eafc..84bdd2004bbd91d6f9ef8bf6a42ee8586c1a5abe 100644
--- a/test/mjsunit/compiler/osr-with-args.js
+++ b/test/mjsunit/regress/regress-regexp-construct-result.js
@@ -25,20 +25,21 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --use-osr
+// Create a huge regexp with many alternative capture groups, most of
+// which do not capture anything, but the corresponding capture slot
+// in the result object has to exist, even though filled with undefined.
+// Having a large result array helps stressing GC.
 
-function f() {
-  var sum = 0;
-  for (var i = 0; i < 1000000; i++) {
-    var t = arguments[0] + 2;
-    var x = arguments[1] + 2;
-    var y = t + x + 5;
-    var z = y + 3;
-    sum += z;
-  }
-  return sum;
+var num_captures = 1000;
+var regexp_string = "(a)";
+for (var i = 0; i < num_captures - 1; i++) {
+  regexp_string += "|(b)";
 }
+var regexp = new RegExp(regexp_string);
 
-for (var i = 0; i < 4; i++) {
-  assertEquals(17000000, f(2, 3));
+for (var i = 0; i < 10; i++) {
+  var matches = regexp.exec("a");
+  var count = 0;
+  matches.forEach(function() { count++; });
+  assertEquals(num_captures + 1, count);
 }