[regexp] Use consistent map checks for fast paths

src/builtins/builtins-regexp.cc

Index: src/builtins/builtins-regexp.cc
diff --git a/src/builtins/builtins-regexp.cc b/src/builtins/builtins-regexp.cc
index dcf45d5177b5b68017da747c33314bfbed407fb0..65df206e56146d01165ef4ceb5137310189410fc 100644
--- a/src/builtins/builtins-regexp.cc
+++ b/src/builtins/builtins-regexp.cc
@@ -1290,23 +1290,17 @@ BUILTIN(RegExpPrototypeSplit) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, string,
                                      Object::ToString(isolate, string_obj));
 
+  if (RegExpUtils::IsUnmodifiedRegExp(isolate, recv)) {
+    RETURN_RESULT_OR_FAILURE(
+        isolate,
+        RegExpSplit(isolate, Handle<JSRegExp>::cast(recv), string, limit_obj));
+  }
+
   Handle<JSFunction> regexp_fun = isolate->regexp_function();
   Handle<Object> ctor;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, ctor, SpeciesConstructor(isolate, recv, regexp_fun));
 
-  if (recv->IsJSRegExp() && *ctor == *regexp_fun) {
-    Handle<Object> exec;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, exec, JSObject::GetProperty(
-                           recv, factory->NewStringFromAsciiChecked("exec")));
-    if (RegExpUtils::IsBuiltinExec(exec)) {
-      RETURN_RESULT_OR_FAILURE(
-          isolate, RegExpSplit(isolate, Handle<JSRegExp>::cast(recv), string,
-                               limit_obj));
-    }
-  }
-
   Handle<Object> flags_obj;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, flags_obj, JSObject::GetProperty(recv, factory->flags_string()));