[string] Migrate String.prototype.{split,replace} to TF

test/mjsunit/string-replace.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 265 matching lines @@
   // followed by "0", $61 as $6, followed by "1" and so on.
   var tail = subject.substr(59);
   for (var i = 60; i < 100; i++) {
     assertEquals(String.fromCharCode(i / 10 + 23) + (i % 10) + tail,
                  subject.replace(re, "$" + i));
   }
 }
 
 testIndices59(new RegExp(regexp59pattern));
 testIndices59(new RegExp(regexp59pattern, "g"));
+
+// Test that ToString(replace) is called.
+
+let replace_tostring_count = 0;
+const fake_replacer = {
+  [Symbol.toPrimitive]: () => { replace_tostring_count++; return "b"; }
+};
+
+"a".replace("x", fake_replacer);
+assertEquals(1, replace_tostring_count);
+
+"a".replace("a", fake_replacer);
+assertEquals(2, replace_tostring_count);