Handlify concat string and substring.

test/mjsunit/string-slices.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 204 matching lines @@
     assertEquals(b.charAt(i), c.charAt(i));
     assertEquals(b.charAt(4), c.charAt(4));
     assertTrue(/3456789qwe/.test(c));
     assertEquals(4, c.indexOf("678"));
     assertEquals("2345", c.split("6")[0]);
   }
 }
 
 test_crankshaft();
 %OptimizeFunctionOnNextCall(test_crankshaft);
-test_crankshaft();
+test_crankshaft();
+
+var s1 = "12345678901234567890";
+var s2 = "abcdefghijklmnopqrstuvwxyz";
+var c1 = s1 + s2;
+var c2 = s1 + c1 + s2;
+assertEquals("234567890123456789", c1.substring(1, 19));
+assertEquals("bcdefghijklmno", c1.substring(21, 35));
+assertEquals("2345678901234567890abcdefghijklmno", c1.substring(1, 35));
+assertEquals("234567890123456789", c2.substring(1, 19));
+assertEquals("bcdefghijklmno", c2.substring(41, 55));
+assertEquals("2345678901234567890abcdefghijklmno", c2.substring(21, 55));