Implement function proxies (except for their use as constructors).

src/string.js

Index: src/string.js
diff --git a/src/string.js b/src/string.js
index 2a5c95e4501775e55a3651190717ecc404e7b791..3191fc422af9d3100dd5a484fed2710f5a066726 100644
--- a/src/string.js
+++ b/src/string.js
@@ -223,7 +223,7 @@ function StringReplace(search, replace) {
   // Delegate to one of the regular expression variants if necessary.
   if (IS_REGEXP(search)) {
     %_Log('regexp', 'regexp-replace,%0r,%1S', [search, subject]);
-    if (IS_FUNCTION(replace)) {
+    if (IS_SPEC_FUNCTION(replace)) {
       if (search.global) {
         return StringReplaceGlobalRegExpWithFunction(subject, search, replace);
       } else {
@@ -250,7 +250,7 @@ function StringReplace(search, replace) {
   builder.addSpecialSlice(0, start);
 
   // Compute the string to replace with.
-  if (IS_FUNCTION(replace)) {
+  if (IS_SPEC_FUNCTION(replace)) {
     var receiver =
         %_IsNativeOrStrictMode(replace) ? void 0 : %GetGlobalReceiver();
     builder.add(%_CallFunction(receiver,