Insert conversion to string in string.replace.

(missing since r13761)

R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12316158

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/string.js

@@ -243,6 +243,8 @@ function StringReplace(search, replace) {
     %_Log('regexp', 'regexp-replace,%0r,%1S', [search, subject]);
 
     if (!IS_SPEC_FUNCTION(replace)) {
+      replace = TO_STRING_INLINE(replace);
+
       if (!search.global) {
         // Non-global regexp search, string replace.
         var match = DoRegExpExec(search, subject, 0);
@@ -250,7 +252,6 @@ function StringReplace(search, replace) {
           search.lastIndex = 0
           return subject;
         }
-        replace = TO_STRING_INLINE(replace);
         if (replace.length == 0) {
           return %_SubString(subject, 0, match[CAPTURE0]) +
                  %_SubString(subject, match[CAPTURE1], subject.length)

test/mjsunit/string-replace.js

@@ -216,10 +216,18 @@ assertEquals('She sells sea$schells by the sea$schore.',
 
 var replace_obj = { length: 0, toString: function() { return "x"; }};
 assertEquals("axc", "abc".replace(/b/, replace_obj));
+assertEquals("axc", "abc".replace(/b/g, replace_obj));
 
 var search_obj = { length: 1, toString: function() { return "b"; }};
 assertEquals("axc", "abc".replace(search_obj, function() { return "x"; }));
 
+var side_effect_flag = false;
+var replace_obj_side_effects = {
+    toString: function() { side_effect_flag = true; return "x" }
+}
+assertEquals("abc", "abc".replace(/z/g, function() { return "x"; }));
+assertTrue(side_effect_flag);  // Side effect triggers even without a match.
+
 var regexp99pattern = "";
 var subject = "";
 for (var i = 0; i < 99; i++) {