[string] Migrate String.prototype.{split,replace} to TF

src/bootstrapper.cc

Index: src/bootstrapper.cc
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 95a7f419b6253d05d15b2a79c395c8d892d30c92..da25d060ff14446258a2760ec2dc8b9dc2379130 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1587,6 +1587,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                           Builtins::kStringPrototypeLocaleCompare, 1, true);
     SimpleInstallFunction(prototype, "normalize",
                           Builtins::kStringPrototypeNormalize, 0, false);
+    SimpleInstallFunction(prototype, "split", Builtins::kStringPrototypeSplit,
+                          2, true);
+    SimpleInstallFunction(prototype, "replace",
+                          Builtins::kStringPrototypeReplace, 2, true);
     SimpleInstallFunction(prototype, "substr", Builtins::kStringPrototypeSubstr,
                           2, true);
     SimpleInstallFunction(prototype, "substring",
@@ -3800,7 +3804,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
   DCHECK(JSObject::cast(
       string_function->initial_map()->prototype())->HasFastProperties());
   native_context()->set_string_function_prototype_map(
-      HeapObject::cast(string_function->initial_map()->prototype())->map());
+      HeapObject::cast(string_function->map()->prototype())->map());
 
   Handle<JSGlobalObject> global_object =
       handle(native_context()->global_object());