ReceiverCheckMode needs to be utilized further.

src/ia32/code-stubs-ia32.cc

Index: src/ia32/code-stubs-ia32.cc
diff --git a/src/ia32/code-stubs-ia32.cc b/src/ia32/code-stubs-ia32.cc
index 35ea821b60323fdc7311dfd8db5d9198271a4305..d64289882d0086b9200a56583da27b7c3da87454 100644
--- a/src/ia32/code-stubs-ia32.cc
+++ b/src/ia32/code-stubs-ia32.cc
@@ -702,8 +702,6 @@ void LoadIndexedStringStub::Generate(MacroAssembler* masm) {
   Register result = eax;
   DCHECK(!result.is(scratch));
 
-  // TODO(mvstanton): the generator doesn't need to verify that
-  // receiver is a string map, that is done outside the handler.
   StringCharAtGenerator char_at_generator(receiver, index, scratch, result,
                                           &miss,  // When not a string.
                                           &miss,  // When not a number.
@@ -3159,8 +3157,9 @@ void SubStringStub::Generate(MacroAssembler* masm) {
   // ebx: instance type
   // ecx: sub string length (smi)
   // edx: from index (smi)
-  StringCharAtGenerator generator(
-      eax, edx, ecx, eax, &runtime, &runtime, &runtime, STRING_INDEX_IS_NUMBER);
+  StringCharAtGenerator generator(eax, edx, ecx, eax, &runtime, &runtime,
+                                  &runtime, STRING_INDEX_IS_NUMBER,
+                                  RECEIVER_IS_STRING);
   generator.GenerateFast(masm);
   __ ret(3 * kPointerSize);
   generator.SkipSlow(masm, &runtime);