Remove invalid DCHECK in ReplacementStringBuilder

The DCHECK verified capacity just before the call to EnsureCapacity()
(which extends capacity if needed). This DCHECK can just be removed
since FixedArray::set() already checks the given index is in-bounds.

Drive-by: Remove similar duplicate DCHECKs in FixedArrayBuilder.

Bug: chromium:933776
Change-Id: I9f058548063a170ea6dce112a3877792887efcca
Reviewed-on: https://chromium-review.googlesource.com/c/1479955Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59753}

src/string-builder.cc

@@ -141,7 +141,6 @@ void FixedArrayBuilder::EnsureCapacity(Isolate* isolate, int elements) {
 
 void FixedArrayBuilder::Add(Object value) {
   DCHECK(!value->IsSmi());
-  DCHECK(length_ < capacity());
   array_->set(length_, value);
   length_++;
   has_non_smi_elements_ = true;
@@ -149,7 +148,6 @@ void FixedArrayBuilder::Add(Object value) {
 
 void FixedArrayBuilder::Add(Smi value) {
   DCHECK(value->IsSmi());
-  DCHECK(length_ < capacity());
   array_->set(length_, value);
   length_++;
 }
@@ -225,7 +223,6 @@ MaybeHandle<String> ReplacementStringBuilder::ToString() {
 
 void ReplacementStringBuilder::AddElement(Object element) {
   DCHECK(element->IsSmi() || element->IsString());
-  DCHECK(array_builder_.capacity() > array_builder_.length());
   EnsureCapacity(1);
   array_builder_.Add(element);
 }

test/mjsunit/regress/regress-933776.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+__v_51351 = /[^]$/gm;
+"a\nb\rc\n\rd\r\ne".replace(__v_51351, "*$1");