[array] Disable DCHECK in RemoveArrayHoles.

This CL disables a DCHECK in RemoveArrayHoles that was triggered for
JSArrays that have read-only elements in the prototype chain.

The DCHECK is not removed because it will be re-enabled later when
the copying from the prototype chain (during sorting) will be done
for JSArrays as well.

R=cbruni@chromium.org

Bug: chromium:840855
Change-Id: Ia278bd2f060df094f477b4efbc3f5bdafd7ea7a8
Reviewed-on: https://chromium-review.googlesource.com/1057588Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#53159}

src/runtime/runtime-array.cc

@@ -146,7 +146,10 @@ Object* PrepareElementsForSortGeneric(Handle<JSReceiver> receiver,
                                         isolate->factory()->undefined_value(),
                                         LanguageMode::kStrict));
   }
-  DCHECK_LE(current_pos, num_indices);
+  // TODO(szuend): Re-enable when we also copy from the prototype chain for
+  //               JSArrays. Then we can use HasOwnProperty instead of
+  //               HasElement and this condition will hold.
+  // DCHECK_LE(current_pos, num_indices);
 
   // Deleting everything after the undefineds up unto the limit.
   for (int i = num_indices - 1; i >= 0; --i) {