Bug 1066040 - IonMonkey: Implement the StringReplace recover instruction. r=nbp