[regexp] Port RegExp.prototype[@@replace]

test/mjsunit/regexp.js

Index: test/mjsunit/regexp.js
diff --git a/test/mjsunit/regexp.js b/test/mjsunit/regexp.js
index ddaf022d19dc13561b08c1c4cbb2a5f3b85cdc49..4087790d01f0f3a76fe43eac107f492a65a0bab7 100644
--- a/test/mjsunit/regexp.js
+++ b/test/mjsunit/regexp.js
@@ -731,3 +731,11 @@ assertEquals(["acbc", "c", "c"], /a(.\2)b(\1)/.exec("aabcacbc"));
 // \u{daff}\u{e000} is not a surrogate pair, while \u{daff}\u{dfff} is.
 assertEquals(["\u{daff}", "\u{e000}"], "\u{daff}\u{e000}".split(/[a-z]{0,1}/u));
 assertEquals(["\u{daff}\u{dfff}"], "\u{daff}\u{dfff}".split(/[a-z]{0,1}/u));
+
+// Test that changing a property on RegExp.prototype results in us taking the
+// slow path, which executes RegExp.prototype.exec instead of our
+// RegExpExecStub.
+const RegExpPrototypeExec = RegExp.prototype.exec;
+RegExp.prototype.exec = function() { throw new Error(); }
+assertThrows(() => "abc".replace(/./, ""));
+RegExp.prototype.exec = RegExpPrototypeExec;