Land patch by Pavel Podivilov (podivilov@chromium.org).

src/x64/ic-x64.cc

Index: src/x64/ic-x64.cc
diff --git a/src/x64/ic-x64.cc b/src/x64/ic-x64.cc
index 7212c05df0def1901ec490a631c58ae660636ac0..7bfccd5e9842f368008f35fe1c8b77b42846646b 100644
--- a/src/x64/ic-x64.cc
+++ b/src/x64/ic-x64.cc
@@ -524,7 +524,32 @@ void KeyedLoadIC::GenerateString(MacroAssembler* masm) {
   //  -- rsp[16] : receiver
   // -----------------------------------
 
-  GenerateGeneric(masm);
+  Label miss, index_ok;
+
+  // Check that the receiver isn't a smi.
+  __ movq(rcx, Operand(rsp, 2 * kPointerSize));
+  __ JumpIfSmi(rcx, &miss);
+
+  // Check that the receiver is a string.
+  Condition is_string = masm->IsObjectStringType(rcx, rax, rbx);
+  __ j(NegateCondition(is_string), &miss);
+
+  // Check if key is a smi or a heap number.
+  __ movq(rax, Operand(rsp, kPointerSize));
+  __ JumpIfSmi(rax, &index_ok);
+  __ CheckMap(rax, Factory::heap_number_map(), &miss, false);
+
+  __ bind(&index_ok);
+  // Duplicate receiver and key since they are expected on the stack after
+  // the KeyedLoadIC call.
+  __ pop(rbx);  // return address
+  __ push(rcx);  // receiver
+  __ push(rax);  // key
+  __ push(rbx);  // return address
+  __ InvokeBuiltin(Builtins::STRING_CHAR_AT, JUMP_FUNCTION);
+
+  __ bind(&miss);
+  GenerateMiss(masm);
 }