ThinStrings: fix CodeStubAssembler::SubString

test/mjsunit/regress/regress-crbug-685965.js

Index: test/mjsunit/regress/regress-crbug-685965.js
diff --git a/test/mjsunit/regress/regress-crbug-685965.js b/test/mjsunit/regress/regress-crbug-685965.js
new file mode 100644
index 0000000000000000000000000000000000000000..1f2c6c8536c982b02a08ba05464baa5357320335
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-685965.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_0(a) {
+  var __v_3 = a + undefined;
+  var __v_0 = __v_3.substring(0, 20);
+  var __v_1 = {};
+  __v_1[__v_3];
+  return __v_0;
+}
+__v_4 = __f_0( "abcdefghijklmnopqrstuvwxyz");
+assertEquals("bcdefg", __v_4.substring(7, 1));