Fix HTML string methods to not depend on replace method

src/string.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
@@ skipping 828 matching lines @@
     var code = %_Arguments(i);
     if (!%_IsSmi(code)) code = $toNumber(code) & 0xffff;
     %_TwoByteSeqStringSetChar(j, code, two_byte);
   }
   return one_byte + two_byte;
 }
 
 
 // ES6 draft, revision 26 (2014-07-18), section B.2.3.2.1
 function HtmlEscape(str) {
-  return TO_STRING_INLINE(str).replace(/"/g, """);
+  return %_CallFunction(TO_STRING_INLINE(str), /"/g, """, StringReplace);
 }
 
 
 // ES6 draft, revision 26 (2014-07-18), section B.2.3.2
 function StringAnchor(name) {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.anchor");
   return "<a name=\"" + HtmlEscape(name) + "\">" + TO_STRING_INLINE(this) +
          "</a>";
 }
 
@@ skipping 328 matching lines @@
 // -------------------------------------------------------------------
 // Exports
 
 utils.Export(function(to) {
   to.StringCharAt = StringCharAtJS;
   to.StringIndexOf = StringIndexOfJS;
   to.StringSubstring = StringSubstring;
 });
 
 })