[turbofan] Add support for String.prototype.charCodeAt/charAt.

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index 14b56fed6eab40b191d87a184813c582d148dcc3..53d6232eaa34752688592f1114f539b7daf81926 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -131,7 +131,10 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
     control = graph()->NewNode(common()->IfFalse(), branch);
     receiverissmi_control = graph()->NewNode(common()->IfTrue(), branch);
     receiverissmi_effect = effect;
-  } else {
+  } else if (access_infos.size() != 1 ||
+             !access_infos[0].receiver_type()->Is(Type::String())) {
+    // TODO(bmeurer): We omit the Smi check here if we are going to lower to
+    // the CheckString below; make this less horrible and adhoc.
     receiver = effect = graph()->NewNode(simplified()->CheckTaggedPointer(),
                                          receiver, effect, control);
   }