[regexp] Work around gcc bug triggering -Werror=strict-overflow

src/runtime/runtime-regexp.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
@@ skipping 1320 matching lines @@
     bool ok;
     Handle<String> capture =
         RegExpUtils::GenericCaptureGetter(isolate, match_indices, j, &ok);
     if (ok) {
       argv[j] = capture;
     } else {
       argv[j] = factory->undefined_value();
     }
   }
 
-  argv[m] = handle(Smi::FromInt(index), isolate);
-  argv[m + 1] = subject;
+  argv[argc - 2] = handle(Smi::FromInt(index), isolate);
+  argv[argc - 1] = subject;
 
   Handle<Object> replacement_obj;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, replacement_obj,
       Execution::Call(isolate, replace_obj, factory->undefined_value(), argc,
                       argv.start()),
       String);
 
   Handle<String> replacement;
   ASSIGN_RETURN_ON_EXCEPTION(
@@ skipping 299 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_IsRegExp) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 1);
   CONVERT_ARG_CHECKED(Object, obj, 0);
   return isolate->heap()->ToBoolean(obj->IsJSRegExp());
 }
 
 }  // namespace internal
 }  // namespace v8