[string] Migrate String.prototype.{split,replace} to TF

src/bootstrapper.cc

Index: src/bootstrapper.cc
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 402eb1a7fc72c7303faa79979ece12fe66ccc6df..3475ae63cddedc17e538d7aabb03d1d6fddb9405 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1586,6 +1586,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                           Builtins::kStringPrototypeLocaleCompare, 1, true);
     SimpleInstallFunction(prototype, "normalize",
                           Builtins::kStringPrototypeNormalize, 0, false);
+    SimpleInstallFunction(prototype, "split", Builtins::kStringPrototypeSplit,
+                          2, true);
+    SimpleInstallFunction(prototype, "replace",
+                          Builtins::kStringPrototypeReplace, 2, true);
     SimpleInstallFunction(prototype, "substr", Builtins::kStringPrototypeSubstr,
                           2, true);
     SimpleInstallFunction(prototype, "substring",
@@ -3794,7 +3798,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
   DCHECK(JSObject::cast(
       string_function->initial_map()->prototype())->HasFastProperties());
   native_context()->set_string_function_prototype_map(
-      HeapObject::cast(string_function->initial_map()->prototype())->map());
+      HeapObject::cast(string_function->map()->prototype())->map());
 
   Handle<JSGlobalObject> global_object =
       handle(native_context()->global_object());