Revert "[regexp] Only append to JSRegExpResult's initial map if we add descriptor"

This reverts commit dc1cc223.

Reason for revert: This was already reverted in https://crrev.com/c/1768897, but the revert did not work.

Original change's description:
> [regexp] Only append to JSRegExpResult's initial map if we add descriptor
> 
> Before this cl, we always added slack to JSRegExpResult's initial_map.
> However, this is incorrect. Now we only add slack to JSRegExpResult's initial map
> if we intend to actually append the indices descriptor.
> 
> Bug: chromium:996099
> Change-Id: Iac23e92415a9b60409915ff1de9634326ed109c5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763064
> Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63297}

TBR=jgruber@chromium.org,joshualitt@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:996099
Change-Id: I0c5df2165a3613f72bbcf674337f6f22f4506d90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768585Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63383}

src/init/bootstrapper.cc

@@ -285,7 +285,8 @@ class Genesis {
   void TransferIndexedProperties(Handle<JSObject> from, Handle<JSObject> to);
 
   Handle<Map> CreateInitialMapForArraySubclass(int size,
-                                               int inobject_properties);
+                                               int inobject_properties,
+                                               int additional_properties = 0);
 
   static bool CompileExtension(Isolate* isolate, v8::Extension* extension);
 
@@ -4430,7 +4431,6 @@ void Genesis::InitializeGlobal_harmony_regexp_match_indices() {
   Descriptor d = Descriptor::AccessorConstant(
       factory()->indices_string(), factory()->regexp_result_indices_accessor(),
       NONE);
-  Map::EnsureDescriptorSlack(isolate(), initial_map, 1);
   initial_map->AppendDescriptor(isolate(), &d);
 }
 
@@ -4917,8 +4917,10 @@ bool Genesis::InstallNatives() {
     // JSRegExpResult initial map.
     // Add additional slack to the initial map in case regexp_match_indices
     // are enabled to account for the additional descriptor.
+    int additional_slack = 1;
     Handle<Map> initial_map = CreateInitialMapForArraySubclass(
-        JSRegExpResult::kSize, JSRegExpResult::kInObjectPropertyCount);
+        JSRegExpResult::kSize, JSRegExpResult::kInObjectPropertyCount,
+        additional_slack);
 
     // index descriptor.
     {
@@ -5370,7 +5372,8 @@ void Genesis::TransferObject(Handle<JSObject> from, Handle<JSObject> to) {
 }
 
 Handle<Map> Genesis::CreateInitialMapForArraySubclass(int size,
-                                                      int inobject_properties) {
+                                                      int inobject_properties,
+                                                      int additional_slack) {
   // Find global.Array.prototype to inherit from.
   Handle<JSFunction> array_constructor(native_context()->array_function(),
                                        isolate());
@@ -5388,8 +5391,9 @@ Handle<Map> Genesis::CreateInitialMapForArraySubclass(int size,
 
   // Update map with length accessor from Array.
   static constexpr int kTheLengthAccessor = 1;
-  Map::EnsureDescriptorSlack(isolate(), initial_map,
-                             inobject_properties + kTheLengthAccessor);
+  Map::EnsureDescriptorSlack(
+      isolate(), initial_map,
+      inobject_properties + kTheLengthAccessor + additional_slack);
 
   // length descriptor.
   {