Fix crash in string replace with regexp. If the suffix of the subject...

Fix crash in string replace with regexp.  If the suffix of the subject
string is larger than 2047 chars we will encode the slice as two Smis
instead of one.  The calculation of the max size of the string builder
did not take this into account.

BUG=http://code.google.com/p/v8/issues/detail?id=515

Committed: http://code.google.com/p/v8/source/detail?r=3334

[Mads Ager (chromium), 2009-11-18 18:44:17]

New snapshot uploaded.  The same problem exists when encoding the previous
string as two Smis instead of one.

Ready for review.

[Kasper Lund, 2009-11-18 18:46:18]

LGTM.