Avoid relying on monkey-patchable things in String.prototype.split.

src/string.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 639 matching lines @@
   if (length === 0) {
     if (DoRegExpExec(separator, subject, 0, 0) != null) {
       return [];
     }
     return [subject];
   }
 
   var currentIndex = 0;
   var startIndex = 0;
   var startMatch = 0;
-  var result = [];
+  var result = new InternalArray();
 
   outer_loop:
   while (true) {
 
     if (startIndex === length) {
       result.push(%_SubString(subject, currentIndex, length));
       break;
     }
 
     var matchInfo = DoRegExpExec(separator, subject, startIndex);
@@ skipping 20 matching lines @@
       if (end != -1) {
         result.push(%_SubString(subject, start, end));
       } else {
         result.push(void 0);
       }
       if (result.length === limit) break outer_loop;
     }
 
     startIndex = currentIndex = endIndex;
   }
-  return result;
+  return %MoveArrayContents(result, []);
 }
 
 
 // ECMA-262 section 15.5.4.15
 function StringSubstring(start, end) {
   if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
     throw MakeTypeError("called_on_null_or_undefined",
                         ["String.prototype.subString"]);
   }
   var s = TO_STRING_INLINE(this);
@@ skipping 288 matching lines @@
     "fixed", StringFixed,
     "italics", StringItalics,
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup
   ));
 }
 
 SetUpString();