Fix bogus insertion of filler in LO-space by String#replace.

test/mjsunit/regress/regress-crbug-493779.js

Index: test/mjsunit/regress/regress-crbug-493779.js
diff --git a/test/mjsunit/compiler/regress-463056.js b/test/mjsunit/regress/regress-crbug-493779.js
similarity index 57%
copy from test/mjsunit/compiler/regress-463056.js
copy to test/mjsunit/regress/regress-crbug-493779.js
index fb871618e42c9387d38a445522bfd01cfbbe9bfa..1071ed23ac95a50cc3312cf1d29f75fafd0599a8 100644
--- a/test/mjsunit/compiler/regress-463056.js
+++ b/test/mjsunit/regress/regress-crbug-493779.js
@@ -2,8 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-function f() {
- return ((0%0)&1) + (1>>>(0%0));
-}
+// Flags: --enable-slow-asserts
 
-f();
+var s = "\u1234-------";
+for (var i = 0; i < 17; i++) {
+  s += s;
+}
+s.replace(/[\u1234]/g, "");