Relax a too-strict DCHECKs.

This allows updates to SLOW_STRING_WRAPPER_ELEMENTS elements kind
for non-extensible map (so far only dictionary elements and typed-array
elements were allowed).

Bug: chromium:932101
Change-Id: Id532684aa94f908eb14f3451aa823f282342668b
Reviewed-on: https://chromium-review.googlesource.com/c/1475390Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59621}

src/map-updater.cc

@@ -324,6 +324,7 @@ MapUpdater::State MapUpdater::FindRootMap() {
     // We want to build transitions to the original element kind (before
     // the seal transitions), so change {to_kind} accordingly.
     DCHECK(to_kind == DICTIONARY_ELEMENTS ||
+           to_kind == SLOW_STRING_WRAPPER_ELEMENTS ||
            IsFixedTypedArrayElementsKind(to_kind));
     to_kind = integrity_source_map_->elements_kind();
   }

test/mjsunit/regress-932101.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+o = Object("A");
+o.x = 1;
+Object.seal(o);
+o.x = 0.1
+
+o[1] = "b";
+assertEquals(undefined, o[1]);