Insert conversion to string in string.replace.

src/string.js

Index: src/string.js
diff --git a/src/string.js b/src/string.js
index 6054e908ae51e655b757e8b1f7be9e39eb608cf2..2f8043c60917a444a77cab71e8af5fb28ca2fa81 100644
--- a/src/string.js
+++ b/src/string.js
@@ -243,6 +243,8 @@ function StringReplace(search, replace) {
     %_Log('regexp', 'regexp-replace,%0r,%1S', [search, subject]);
 
     if (!IS_SPEC_FUNCTION(replace)) {
+      replace = TO_STRING_INLINE(replace);
+
       if (!search.global) {
         // Non-global regexp search, string replace.
         var match = DoRegExpExec(search, subject, 0);
@@ -250,7 +252,6 @@ function StringReplace(search, replace) {
           search.lastIndex = 0
           return subject;
         }
-        replace = TO_STRING_INLINE(replace);
         if (replace.length == 0) {
           return %_SubString(subject, 0, match[CAPTURE0]) +
                  %_SubString(subject, match[CAPTURE1], subject.length)