[regexp] Don't cache exec method in Regexp.proto[@@split]

src/js/regexp.js

Index: src/js/regexp.js
diff --git a/src/js/regexp.js b/src/js/regexp.js
index 396b694ea65a35a03292a2a0d964690297121397..266d6b6c529e62a4a31a034982f77c28f3b0ff32 100644
--- a/src/js/regexp.js
+++ b/src/js/regexp.js
@@ -344,9 +344,8 @@ function RegExpSubclassSplit(string, limit) {
 
   // TODO(adamk): this fast path is wrong as we doesn't ensure that 'exec'
   // is actually a data property on RegExp.prototype.
-  var exec;
   if (IS_REGEXP(this) && constructor === GlobalRegExp) {
-    exec = this.exec;
+    var exec = this.exec;
     if (exec === RegExpExecJS) {
       return %_Call(RegExpSplit, this, string, limit);
     }
@@ -371,9 +370,7 @@ function RegExpSubclassSplit(string, limit) {
   var stringIndex = prevStringIndex;
   while (stringIndex < size) {
     splitter.lastIndex = stringIndex;
-    result = RegExpSubclassExec(splitter, string, exec);
-    // Ensure exec will be read again on the next loop through.
-    exec = UNDEFINED;
+    result = RegExpSubclassExec(splitter, string);
     if (IS_NULL(result)) {
       stringIndex += AdvanceStringIndex(string, stringIndex, unicode);
     } else {