[csa] SubString should enforce Stringness of first parameter.

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 
 namespace v8 {
 namespace internal {
@@ skipping 3274 matching lines @@
 
   // Int32 variables.
   Variable var_instance_type(this, MachineRepresentation::kWord32, int_zero);
   Variable var_representation(this, MachineRepresentation::kWord32, int_zero);
 
   Variable var_from(this, MachineRepresentation::kTagged, from);      // Smi.
   Variable var_string(this, MachineRepresentation::kTagged, string);  // String.
   Variable var_result(this, MachineRepresentation::kTagged);          // String.
 
   // Make sure first argument is a string.
-
-  // Bailout if receiver is a Smi.
-  GotoIf(TaggedIsSmi(string), &runtime);
+  CSA_ASSERT(this, TaggedIsNotSmi(string));
+  CSA_ASSERT(this, IsString(string));
 
   // Load the instance type of the {string}.
   Node* const instance_type = LoadInstanceType(string);
   var_instance_type.Bind(instance_type);
 
-  // Check if {string} is a String.
-  GotoUnless(IsStringInstanceType(instance_type), &runtime);
-
   // Make sure that both from and to are non-negative smis.
 
   GotoUnless(TaggedIsPositiveSmi(from), &runtime);
   GotoUnless(TaggedIsPositiveSmi(to), &runtime);
 
   Node* const substr_length = SmiSub(to, from);
   Node* const string_length = LoadStringLength(string);
 
   // Begin dispatching based on substring length.
 
@@ skipping 5047 matching lines @@
         formatted.c_str(), TENURED);
     CallRuntime(Runtime::kGlobalPrint, NoContextConstant(),
                 HeapConstant(string));
   }
   CallRuntime(Runtime::kDebugPrint, NoContextConstant(), tagged_value);
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8