This adds a fast-path for calls to RegExp.prototype[@@replace] for cases in
which the given regexp is unmodified and global, and the given replace argument
is callable.

The fast-path implementation itself is almost identical to the original JS
implementation except that it currently does not reuse result_array.

SunSpider/unpack-code relies heavily on this codepath.

BUG=v8:5339

Review-Url: https://chromiumcodereview.appspot.com/2433923003
Cr-Commit-Position: refs/heads/master@{#40504}