Fix bug 1070: set correct holder for primitive checks.

test/mjsunit/string-charcodeat.js

Index: test/mjsunit/string-charcodeat.js
diff --git a/test/mjsunit/string-charcodeat.js b/test/mjsunit/string-charcodeat.js
index fb7ab9af86c3505df9aac480e8757a7bca5789e3..e3cbc7d6e3f1ab7b247bee12022c381fe1772232 100644
--- a/test/mjsunit/string-charcodeat.js
+++ b/test/mjsunit/string-charcodeat.js
@@ -28,7 +28,6 @@
 /**
  * @fileoverview Check all sorts of borderline cases for charCodeAt.
  */
-
 function Cons() {
   return "Te" + "st testing 123";
 }
@@ -205,3 +204,20 @@ assertTrue(isNaN(long.charCodeAt(-1)), 35);
 assertEquals(49, long.charCodeAt(0), 36);
 assertEquals(56, long.charCodeAt(65535), 37);
 assertTrue(isNaN(long.charCodeAt(65536)), 38);
+
+
+// Test crankshaft code when the function is set directly on the
+// string prototype object instead of the hidden prototype object.
+// See http://code.google.com/p/v8/issues/detail?id=1070
+
+String.prototype.x = String.prototype.charCodeAt;
+
+function directlyOnPrototype() {
+  assertEquals(97, "a".x(0));
+  assertEquals(98, "b".x(0));
+  assertEquals(99, "c".x(0));
+}
+
+for (var i = 0; i < 10000; i++) {
+  directlyOnPrototype();
+}