String.prototype.anchor and others should not cause side effects.

src/js/string.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
@@ skipping 315 matching lines @@
 // ECMA-262, 15.5.4.19
 function StringToLocaleUpperCase() {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.toLocaleUpperCase");
 
   return %StringToUpperCase(TO_STRING(this));
 }
 
 
 // ES6 draft, revision 26 (2014-07-18), section B.2.3.2.1
 function HtmlEscape(str) {
-  return %_Call(StringReplace, TO_STRING(str), /"/g, """);
+  return %RegExpInternalReplace(/"/g, TO_STRING(str), """);
 }
 
 
 // ES6 draft, revision 26 (2014-07-18), section B.2.3.2
 function StringAnchor(name) {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.anchor");
   return "<a name=\"" + HtmlEscape(name) + "\">" + TO_STRING(this) +
          "</a>";
 }
 
@@ skipping 196 matching lines @@
 // Exports
 
 utils.Export(function(to) {
   to.StringMatch = StringMatchJS;
   to.StringReplace = StringReplace;
   to.StringSlice = StringSlice;
   to.StringSplit = StringSplitJS;
 });
 
 })