Only escape U+0022 in argument values of `String.prototype` HTML methods

src/string.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file relies on the fact that the following declaration has been made
 // in runtime.js:
 // var $String = global.String;
 
 // -------------------------------------------------------------------
 
@@ skipping 811 matching lines @@
     var code = %_Arguments(i);
     if (!%_IsSmi(code)) code = ToNumber(code) & 0xffff;
     %_TwoByteSeqStringSetChar(two_byte, j, code);
   }
   return one_byte + two_byte;
 }
 
 
 // ES6 draft, revision 26 (2014-07-18), section B.2.3.2.1
 function HtmlEscape(str) {
-  return TO_STRING_INLINE(str).replace(/</g, "&lt;")
-                              .replace(/>/g, "&gt;")
-                              .replace(/"/g, "&quot;")
-                              .replace(/'/g, "&#039;");
+  return TO_STRING_INLINE(str).replace(/"/g, "&quot;");
 }
 
 
 // ES6 draft, revision 26 (2014-07-18), section B.2.3.2
 function StringAnchor(name) {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.anchor");
   return "<a name=\"" + HtmlEscape(name) + "\">" + this + "</a>";
 }
 
 
@@ skipping 132 matching lines @@
     "fixed", StringFixed,
     "italics", StringItalics,
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup
   ));
 }
 
 SetUpString();