Guard against stack overflow in Runtime::StringReplaceOneCharWithString.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index b82d377f71fda4040cdcb5784c0f14744a64f42b..85260869794cbd9ce978f45cf227a2834942c264 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -4333,7 +4333,10 @@ MaybeHandle<String> StringReplaceOneCharWithString(Isolate* isolate,
                                                    Handle<String> replace,
                                                    bool* found,
                                                    int recursion_limit) {
-  if (recursion_limit == 0) return MaybeHandle<String>();
+  StackLimitCheck stackLimitCheck(isolate);
+  if (stackLimitCheck.HasOverflowed() || (recursion_limit == 0)) {
+    return MaybeHandle<String>();
+  }
   recursion_limit--;
   if (subject->IsConsString()) {
     ConsString* cons = ConsString::cast(*subject);