[string] Migrate String.prototype.{split,replace} to TF

test/debugger/debug/debug-evaluate-no-side-effect-builtins.js

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --ignition --side-effect-free-debug-evaluate
 
 Debug = debug.Debug
 
 var exception = null;
 
@@ skipping 36 matching lines @@
       if (typeof String.prototype[f] === "function") {
         // Do not expect locale-specific or regexp-related functions to work.
         // {Lower,Upper}Case (Locale-specific or not) do not work either.
         if (f.indexOf("locale") >= 0) continue;
         if (f.indexOf("Lower") >= 0) continue;
         if (f.indexOf("Upper") >= 0) continue;
         if (f == "normalize") continue;
         if (f == "match") continue;
         if (f == "search") continue;
         if (f == "split") continue;
+        if (f == "replace") continue;
         success("abcd"[f](2), `"abcd".${f}(2);`);
       }
     }
     fail("'abCd'.toLowerCase()");
     fail("'abcd'.toUpperCase()");
     fail("'abCd'.toLocaleLowerCase()");
     fail("'abcd'.toLocaleUpperCase()");
     fail("'abcd'.match(/a/)");
     fail("'abcd'.replace(/a/)");
     fail("'abcd'.search(/a/)");
@@ skipping 10 matching lines @@
 // Add the debug event listener.
 Debug.setListener(listener);
 
 function f() {
   debugger;
 };
 
 f();
 
 assertNull(exception);