Fix HTML string methods to not depend on replace method

Before this we were using String.prototype.replace. Now
we call the internal StringReplace instead.

BUG=v8:4221
LOG=N
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1199933005

Cr-Commit-Position: refs/heads/master@{#29206}

src/string.js

@@ -846,7 +846,7 @@ function StringFromCharCode(code) {
 
 // ES6 draft, revision 26 (2014-07-18), section B.2.3.2.1
 function HtmlEscape(str) {
-  return TO_STRING_INLINE(str).replace(/"/g, """);
+  return %_CallFunction(TO_STRING_INLINE(str), /"/g, """, StringReplace);
 }
 
 

test/mjsunit/es6/string-html.js

@@ -192,3 +192,10 @@ assertEquals(String.prototype.sup.length, 0);
     assertEquals(1, calls);
   }
 })();
+
+
+(function TestDeleteStringRelace() {
+  assertEquals('<a name="n">s</a>', 's'.anchor('n'));
+  assertTrue(delete String.prototype.replace);
+  assertEquals('<a name="n">s</a>', 's'.anchor('n'));
+})();