[replaceAll] Fix DCHECK hit in runtime with replaceAll.

Bug: chromium:1028475
Change-Id: I0101930e01d41b0f29fa28a257e3dc720069faff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936835Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65214}

src/builtins/string-replaceall.tq

@@ -49,6 +49,13 @@ namespace string {
       return fromIndex;
     }
 
+    // Don't bother to search if the searchString would go past the end
+    // of the string. This is actually necessary because of runtime
+    // checks.
+    if (fromIndex + searchString.length_smi > string.length_smi) {
+      return -1;
+    }
+
     try {
       return TryFastAbstractStringIndexOf(string, searchString, fromIndex)
           otherwise Slow;

test/mjsunit/harmony/string-replaceAll.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --harmony-string-replaceall
+// Flags: --harmony-string-replaceall --allow-natives-syntax
 
 assertEquals('a-b-c-d', 'a+b+c+d'.replaceAll('+', '-'));
 assertEquals('aaaa', 'abcd'.replaceAll(/./g, 'a'));
@@ -98,3 +98,9 @@ assertEquals('ii', '.+*$.+*$'.replaceAll('.+*$', 'i'));
 assertEquals('o ppercase!', 'No Uppercase!'.replaceAll(/[A-Z]/g,  ''));
 assertEquals('o Uppercase?', 'No Uppercase?'.replaceAll(/[A-Z]/gy, ''));
 assertEquals(' UPPERCASE!', 'NO UPPERCASE!'.replaceAll(/[A-Z]/gy, ''));
+
+// Tests for slow path.
+assertEquals('a', 'a'.replaceAll(%ConstructConsString('abcdefghijklmn',
+                                                      'def'), 'b'));
+assertEquals('b', 'abcdefghijklmndef'.replaceAll(
+    %ConstructConsString('abcdefghijklmn', 'def'), 'b'));