[string] Migrate String.prototype.{split,replace} to TF

test/mjsunit/string-replace.js

Index: test/mjsunit/string-replace.js
diff --git a/test/mjsunit/string-replace.js b/test/mjsunit/string-replace.js
index e8392ae2bf0b25bd44e028e47e570dd523317fd8..b391b8c2f5f98c30288cdcb2f66078d5121107dd 100644
--- a/test/mjsunit/string-replace.js
+++ b/test/mjsunit/string-replace.js
@@ -283,3 +283,16 @@ function testIndices59(re) {
 
 testIndices59(new RegExp(regexp59pattern));
 testIndices59(new RegExp(regexp59pattern, "g"));
+
+// Test that ToString(replace) is called.
+
+let replace_tostring_count = 0;
+const fake_replacer = {
+  [Symbol.toPrimitive]: () => { replace_tostring_count++; return "b"; }
+};
+
+"a".replace("x", fake_replacer);
+assertEquals(1, replace_tostring_count);
+
+"a".replace("a", fake_replacer);
+assertEquals(2, replace_tostring_count);