RegExpExec/RegExpTest should not unconditionally speculate cell