[regexp] Fix fallback path in RegExpExec

src/regexp/regexp-utils.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/regexp/regexp-utils.h"
 
 #include "src/factory.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
 #include "src/regexp/jsregexp.h"
@@ skipping 136 matching lines @@
                     Object);
   }
 
   {
     Handle<JSFunction> regexp_exec = isolate->regexp_exec_function();
 
     const int argc = 1;
     ScopedVector<Handle<Object>> argv(argc);
     argv[0] = string;
 
-    return Execution::Call(isolate, exec, regexp_exec, argc, argv.start());
+    return Execution::Call(isolate, regexp_exec, regexp, argc, argv.start());
   }
 }
 
 Maybe<bool> RegExpUtils::IsRegExp(Isolate* isolate, Handle<Object> object) {
   if (!object->IsJSReceiver()) return Just(false);
 
   Handle<JSReceiver> receiver = Handle<JSReceiver>::cast(object);
 
   if (isolate->regexp_function()->initial_map() == receiver->map()) {
     // Fast-path for unmodified JSRegExp instances.
@@ skipping 53 matching lines @@
 
   const int last_index = Handle<Smi>::cast(last_index_obj)->value();
   const int new_last_index =
       last_index + AdvanceStringIndex(isolate, string, last_index, unicode);
 
   return SetLastIndex(isolate, regexp, new_last_index);
 }
 
 }  // namespace internal
 }  // namespace v8