Push fix for issue 1439135 to trunk as V8 version 0.3.5.2.

src/objects.cc

Index: src/objects.cc
===================================================================
--- src/objects.cc	(revision 529)
+++ src/objects.cc	(working copy)
@@ -510,6 +510,12 @@
       ASSERT(!ss->buffer()->IsSlicedString());
       Object* ok = String::cast(ss->buffer())->Flatten();
       if (ok->IsFailure()) return ok;
+      // Under certain circumstances (TryFlatten fails in String::Slice)
+      // we can have a cons string under a slice.  In this case we need
+      // to get the flat string out of the cons!
+      if (String::cast(ok)->StringIsConsString()) {
+        ss->set_buffer(ConsString::cast(ok)->first());
+      }
       return this;
     }
     case kConsStringTag: {