Avoid relying on monkey-patchable things in String.prototype.split.

src/string.js

Index: src/string.js
diff --git a/src/string.js b/src/string.js
index a04b23f7dbb0e54e1b9df385d275a27465e2220d..5db937bc77ca446b935cca394ef8366528006076 100644
--- a/src/string.js
+++ b/src/string.js
@@ -657,7 +657,7 @@ function StringSplitOnRegExp(subject, separator, limit, length) {
   var currentIndex = 0;
   var startIndex = 0;
   var startMatch = 0;
-  var result = [];
+  var result = new InternalArray();
 
   outer_loop:
   while (true) {
@@ -698,7 +698,7 @@ function StringSplitOnRegExp(subject, separator, limit, length) {
 
     startIndex = currentIndex = endIndex;
   }
-  return result;
+  return %MoveArrayContents(result, []);
 }