String.prototype.anchor and others should not cause side effects.

R=jgruber@chromium.org
BUG=v8::5836

Review-Url: https://codereview.chromium.org/2628963005
Cr-Commit-Position: refs/heads/master@{#42308}

src/js/string.js

@@ -333,7 +333,7 @@ function StringToLocaleUpperCase() {
 
 // ES6 draft, revision 26 (2014-07-18), section B.2.3.2.1
 function HtmlEscape(str) {
-  return %_Call(StringReplace, TO_STRING(str), /"/g, """);
+  return %RegExpInternalReplace(/"/g, TO_STRING(str), """);
 }
 
 

test/mjsunit/regress/regress-5836.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var previous = RegExp.lastMatch;
+'hello world'.anchor('"hi"');
+assertEquals(previous, RegExp.lastMatch);