Avoid bailing out to runtime for short substrings.

test/mjsunit/string-external-cached.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 41 matching lines @@
     assertEquals('A', charat_str[i].charAt(3*16 + 10));
     assertEquals('B', charat_str[i].charAt(3*16 + 11));
   }
 
   charat_short = "012";
   try {  // String can only be externalized once
     externalizeString(charat_short, true);
   } catch (ex) { }
   assertEquals("1", charat_short.charAt(1));
 
-  // Test regexp.
+  // Test regexp and short substring.
   var re = /(A|B)/;
   var rere = /(T.{1,2}B)/;
   var ascii = "ABCDEFGHIJKLMNOPQRST";
   var twobyte = "_ABCDEFGHIJKLMNOPQRST";
   try {
     externalizeString(ascii, false);
     externalizeString(twobyte, true);
   } catch (ex) { }
   assertTrue(isAsciiString(ascii));
   assertFalse(isAsciiString(twobyte));
   var ascii_slice = ascii.slice(1,-1);
   var twobyte_slice = twobyte.slice(2,-1);
   var ascii_cons = ascii + ascii;
   var twobyte_cons = twobyte + twobyte;
   for (var i = 0; i < 2; i++) {
     assertEquals(["A", "A"], re.exec(ascii));
     assertEquals(["B", "B"], re.exec(ascii_slice));
     assertEquals(["TAB", "TAB"], rere.exec(ascii_cons));
     assertEquals(["A", "A"], re.exec(twobyte));
     assertEquals(["B", "B"], re.exec(twobyte_slice));
     assertEquals(["T_AB", "T_AB"], rere.exec(twobyte_cons));
+    assertEquals("DEFG", ascii_slice.substr(2, 4));
+    assertEquals("DEFG", twobyte_slice.substr(2, 4));
+    assertEquals("DEFG", ascii_cons.substr(3, 4));
+    assertEquals("DEFG", twobyte_cons.substr(4, 4));
   }
 }
 
 // Run the test many times to ensure IC-s don't break things.
 for (var i = 0; i < 10; i++) {
   test();
 }
 
 // Clean up string to make Valgrind happy.
 gc();
 gc();