Push fix for issue 1439135 to trunk as V8 version 0.3.5.2.

src/objects.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 492 matching lines @@
 
   switch (representation_tag()) {
     case kSlicedStringTag: {
       SlicedString* ss = SlicedString::cast(this);
       // The SlicedString constructor should ensure that there are no
       // SlicedStrings that are constructed directly on top of other
       // SlicedStrings.
       ASSERT(!ss->buffer()->IsSlicedString());
       Object* ok = String::cast(ss->buffer())->Flatten();
       if (ok->IsFailure()) return ok;
+      // Under certain circumstances (TryFlatten fails in String::Slice)
+      // we can have a cons string under a slice.  In this case we need
+      // to get the flat string out of the cons!
+      if (String::cast(ok)->StringIsConsString()) {
+        ss->set_buffer(ConsString::cast(ok)->first());
+      }
       return this;
     }
     case kConsStringTag: {
       ConsString* cs = ConsString::cast(this);
       if (String::cast(cs->second())->length() == 0) {
         return this;
       }
       // There's little point in putting the flat string in new space if the
       // cons string is in old space.  It can never get GCed until there is
       // an old space GC.
@@ skipping 5905 matching lines @@
   // No break point.
   if (break_point_objects()->IsUndefined()) return 0;
   // Single beak point.
   if (!break_point_objects()->IsFixedArray()) return 1;
   // Multiple break points.
   return FixedArray::cast(break_point_objects())->length();
 }
 
 
 } }  // namespace v8::internal