Fix Smi::IsValid assert in StringCharCodeAt deferred code.

test/mjsunit/string-charcodeat.js

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 135 matching lines @@
 TestStringType(Flat, false);
 TestStringType(NotAString, false);
 TestStringType(Cons16, true);
 TestStringType(Deep16, true);
 TestStringType(Slice16Beginning, true);
 TestStringType(Slice16Middle, true);
 TestStringType(Slice16End, true);
 TestStringType(Flat16, true);
 TestStringType(NotAString16, true);
 
+
+function ConsNotSmiIndex() {
+  var str = Cons();
+  assertTrue(isNaN(str.charCodeAt(0x7fffffff)));
+}
+
+for (var i = 0; i < 100000; i++) {
+  ConsNotSmiIndex();
+}
+
+
 for (var i = 0; i != 10; i++) {
   assertEquals(101, Cons16().charCodeAt(1.1));
   assertEquals('e', Cons16().charAt(1.1));
 }
 
 function StupidThing() {
   // Doesn't return a string from toString!
   this.toString = function() { return 42; }
   this.charCodeAt = String.prototype.charCodeAt;
 }
@@ skipping 21 matching lines @@
 
 assertTrue(isNaN(medium.charCodeAt(-1)), 31);
 assertEquals(49, medium.charCodeAt(0), 32);
 assertEquals(56, medium.charCodeAt(255), 33);
 assertTrue(isNaN(medium.charCodeAt(256)), 34);
 
 assertTrue(isNaN(long.charCodeAt(-1)), 35);
 assertEquals(49, long.charCodeAt(0), 36);
 assertEquals(56, long.charCodeAt(65535), 37);
 assertTrue(isNaN(long.charCodeAt(65536)), 38);