Fix broken String.prototype.replace() and replaceAll().