[regexp] Revert to ZoneList usage in @@replace

test/mjsunit/regress/regress-707187.js

Index: test/mjsunit/regress/regress-707187.js
diff --git a/test/mjsunit/regress/regress-707187.js b/test/mjsunit/regress/regress-707187.js
new file mode 100644
index 0000000000000000000000000000000000000000..31a73e2ba0e04ee9e5d57e01fe2362bb4e2ef7fb
--- /dev/null
+++ b/test/mjsunit/regress/regress-707187.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let i = 0;
+let re = /./g;
+re.exec = () => {
+  if (i++ == 0) return { length: 2147483648 };
+  return null;
+};
+
+"".replace(re);