Fix a regression in character-at stub when doing a keyed load on a string. ...

test/mjsunit/regress/regress-900966.js

Index: test/mjsunit/regress/regress-900966.js
===================================================================
--- test/mjsunit/regress/regress-900966.js	(revision 5468)
+++ test/mjsunit/regress/regress-900966.js	(working copy)
@@ -29,6 +29,15 @@
 String.prototype[10] = 'x';
 assertEquals('abc'[10], 'x');
 
+// Test that the fast case character-at stub handles an out-of-bound
+// index correctly. We need to call the function twice to initialize
+// the character-at stub.
+function f() {
+  assertEquals('abc'[10], 'x');
+}
+f();

[Kasper Lund, 2010/09/16 09:17:05]

Add a comment about why you need two calls here.

+f();
+
 assertTrue(2[11] === undefined);
 Number.prototype[11] = 'y';
 assertEquals(2[11], 'y');