Some methods were not allowlisted because in the past, they were
implemented as JS builtins and there were side-effects due to creating
an i18n cache object.

Some other methods were not allowlisted because they run regexps, which
can affect RegExp.$1 etc – that has since then been worked around.

For String.{match, matchAll, replace, replaceAll, split, search} we
invalidate the protector cell to avoid the fast path that inlines calls
to RegExp.prototype[Symbol.*].

Bug: 351769842
Change-Id: I2e5276b81d5b48488fc716d183a7ffa74a225604
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5720968


Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#95118}