[turbofan] ChangeFloat64ToTagged shouldn't canonicalize.

src/js/regexp.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 'use strict';
 
 %CheckIsBootstrapping();
 
@@ skipping 160 matching lines @@
                         'RegExp.prototype.exec', this);
   }
 
   string = TO_STRING(string);
 
   var lastIndex;
   var global = TO_BOOLEAN(REGEXP_GLOBAL(this));
   var sticky = TO_BOOLEAN(REGEXP_STICKY(this));
   var updateLastIndex = global || sticky;
   if (updateLastIndex) {
-    lastIndex = TO_LENGTH(this.lastIndex);
+    // TODO(jgruber): This is actually ToLength in the spec, but we bailout
+    // to the runtime in %_RegExpExec if lastIndex is not a Smi, so we are
+    // smart here and trick both TurboFan and Crankshaft to produce a Smi.
+    // This is a terrible hack, and correct for subtle reasons; it's a clear
+    // indicator that we need a predictable RegExp implementation where we
+    // don't need to add specific work-arounds for certain compiler issues.
+    lastIndex = +this.lastIndex;
     if (lastIndex > string.length) {
       this.lastIndex = 0;
       return null;
+    } else if (lastIndex <= 0) {
+      lastIndex = 0;
     }
+    lastIndex = lastIndex|0;
   } else {
     lastIndex = 0;
   }
 
   // matchIndices is either null or the RegExpLastMatchInfo array.
   var matchIndices = %_RegExpExec(this, string, lastIndex, RegExpLastMatchInfo);
 
   if (IS_NULL(matchIndices)) {
     if (updateLastIndex) this.lastIndex = 0;
     return null;
@@ skipping 929 matching lines @@
   to.GetSubstitution = GetSubstitution;
   to.InternalRegExpMatch = InternalRegExpMatch;
   to.InternalRegExpReplace = InternalRegExpReplace;
   to.IsRegExp = IsRegExp;
   to.RegExpExec = DoRegExpExec;
   to.RegExpInitialize = RegExpInitialize;
   to.RegExpLastMatchInfo = RegExpLastMatchInfo;
 });
 
 })