RegExp: fix cleanup of custom exec results

RegExp: fix cleanup of custom exec results

Previously, RegExp.prototype[Symbol.replace]() and Symbol.split() used
non-NULL exotic slots as proof that an exec() result was an internally
allocated match array.  A custom exec() could return any exotic object, which
was then cast to an array and freed, corrupting unrelated VM state.

The fix is to record whether RegExpBuiltinExec produced each result and to
release only fresh builtin results that could not escape through user code.

The replace issue was introduced in f7813172 (0.8.2), and the split issue was
introduced in aa697e3e (0.8.2).

This closes #1090, #1091, #1092, #1093, #1096, and #1097 issues on GitHub.