VectorICs: keyed element loads were kicking out non-smi keys unnecessarily

test/mjsunit/string-index.js

Index: test/mjsunit/string-index.js
diff --git a/test/mjsunit/string-index.js b/test/mjsunit/string-index.js
index 315708ca5fb5e864c7350b3c36a40120de02dad7..1c0e3d915d18d1bac554d3f76b510052bd117682 100644
--- a/test/mjsunit/string-index.js
+++ b/test/mjsunit/string-index.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 /**
  * @fileoverview Test indexing on strings with [].
  */
@@ -250,6 +252,20 @@ for (var i = 0; i < 100; ++i) {
   assertEquals(expected, actual);
 }
 
+// Test out of range with a heap number case.
+var num = Math.floor(4) * 0.5;
+// TODO(mvstanton): figure out a reliable way to get a heap number every time.
+// assertFalse(!%_IsSmi(num));
+var keys = [0, num];
+var str = 'ab', arr = ['a', undefined];
+for (var i = 0; i < 100; ++i) {
+  var index = Math.floor(i / 50);
+  var key = keys[index];
+  var expected = arr[index];
+  var actual = str[key];
+  assertEquals(expected, actual);
+}
+
 // Test two byte string.
 var str = '\u0427', arr = ['\u0427'];
 for (var i = 0; i < 50; ++i) {