Fix a regression in character-at stub when doing a keyed load on a string. ...

Fix a regression in character-at stub when doing a keyed load on a string. 

Loading from out-of-range has to go to the runtime system to check if there
exists a property with that index in the prototype.


Committed: http://code.google.com/p/v8/source/detail?r=5471

[Kasper Lund, 2010-09-16 09:17:05]

LGTM.

http://codereview.chromium.org/3410011/diff/1/5
File test/mjsunit/regress/regress-900966.js (right):

http://codereview.chromium.org/3410011/diff/1/5#newcode38
test/mjsunit/regress/regress-900966.js:38: f();
Add a comment about why you need two calls here.