Ensure capacity when adding parts in String.replace.

test/mjsunit/regress/regress-2289.js

Index: test/mjsunit/regress/regress-2289.js
diff --git a/test/mjsunit/regress/regress-113924.js b/test/mjsunit/regress/regress-2289.js
similarity index 93%
copy from test/mjsunit/regress/regress-113924.js
copy to test/mjsunit/regress/regress-2289.js
index 3ecdec48f219b9ea545702ebf3a396debe7a93f8..e89ec6e1430751d8abd8ef9a50f133bc892d80cd 100644
--- a/test/mjsunit/regress/regress-113924.js
+++ b/test/mjsunit/regress/regress-2289.js
@@ -25,7 +25,10 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-var count=12000;
-while(count--) {
-  eval("var a = new Object(10); a[2] += 7;");
-}
+var foo = "a";
+for (var i = 0; i < 12; i++) foo += foo;
+foo = foo + 'b' + foo;
+
+foo.replace(/b/, "a");
+
+