[turbofan] ChangeFloat64ToTagged shouldn't canonicalize.

src/js/regexp.js

Index: src/js/regexp.js
diff --git a/src/js/regexp.js b/src/js/regexp.js
index 266d6b6c529e62a4a31a034982f77c28f3b0ff32..71fe64f05930fdcb54fb02192d8a2e0ab9d5813e 100644
--- a/src/js/regexp.js
+++ b/src/js/regexp.js
@@ -178,11 +178,20 @@ function RegExpExecJS(string) {
   var sticky = TO_BOOLEAN(REGEXP_STICKY(this));
   var updateLastIndex = global || sticky;
   if (updateLastIndex) {
-    lastIndex = TO_LENGTH(this.lastIndex);
+    // TODO(jgruber): This is actually ToLength in the spec, but we bailout
+    // to the runtime in %_RegExpExec if lastIndex is not a Smi, so we are
+    // smart here and trick both TurboFan and Crankshaft to produce a Smi.
+    // This is a terrible hack, and correct for subtle reasons; it's a clear
+    // indicator that we need a predictable RegExp implementation where we
+    // don't need to add specific work-arounds for certain compiler issues.
+    lastIndex = +this.lastIndex;
     if (lastIndex > string.length) {
       this.lastIndex = 0;
       return null;
+    } else if (lastIndex <= 0) {
+      lastIndex = 0;
     }
+    lastIndex = lastIndex|0;
   } else {
     lastIndex = 0;
   }