Merge r5471 into 2.3 branch....

test/mjsunit/regress/regress-900966.js

Index: test/mjsunit/regress/regress-900966.js
===================================================================
--- test/mjsunit/regress/regress-900966.js	(revision 5471)
+++ test/mjsunit/regress/regress-900966.js	(working copy)
@@ -29,6 +29,15 @@
 String.prototype[10] = 'x';
 assertEquals('abc'[10], 'x');
 
+// Test that the fast case character-at stub handles an out-of-bound
+// index correctly. We need to call the function twice to initialize
+// the character-at stub.
+function f() {
+  assertEquals('abc'[10], 'x');
+}
+f();
+f();
+
 assertTrue(2[11] === undefined);
 Number.prototype[11] = 'y';
 assertEquals(2[11], 'y');