[regexp] Ensure there are no shape changes on the fast path

src/builtins/builtins-string-gen.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-regexp-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/objects.h"
@@ skipping 951 matching lines @@
     Branch(WordEqual(proto_map, initial_proto_initial_map), &out, &next);
 
     Bind(&next);
   }
 
   // Take the fast path for RegExps.
   {
     Label stub_call(this), slow_lookup(this);
 
     RegExpBuiltinsAssembler regexp_asm(state());
-    regexp_asm.BranchIfFastRegExp(context, object_map, &stub_call,
+    regexp_asm.BranchIfFastRegExp(context, object, object_map, &stub_call,
                                   &slow_lookup);
 
     Bind(&stub_call);
     Return(regexp_call());
 
     Bind(&slow_lookup);
   }
 
   GotoIf(IsNullOrUndefined(object), &out);
 
@@ skipping 670 matching lines @@
     CallRuntime(Runtime::kThrowIncompatibleMethodReceiver, context,
                 HeapConstant(factory()->NewStringFromAsciiChecked(
                     "String Iterator.prototype.next", TENURED)),
                 iterator);
     Unreachable();
   }
 }
 
 }  // namespace internal
 }  // namespace v8