Tentative implementation of string slices (hidden under the flag --string-slices).

test/mjsunit/substr.js

Index: test/mjsunit/substr.js
diff --git a/test/mjsunit/substr.js b/test/mjsunit/substr.js
index f69a9c045c9aaec793ebb71ea162f9244accd05c..cffaf94da2650eb4322a3d63c289c2e7c214e26c 100755
--- a/test/mjsunit/substr.js
+++ b/test/mjsunit/substr.js
@@ -135,3 +135,20 @@ for (var i = 0; i < 10000; i++) {
   assertEquals(xl - (i % xl), z.length);
   cache.push(z);
 }
+
+// Substring of substring.
+var cache = [];
+var last = x;
+var offset = 0;
+for (var i = 0; i < 64; i++) {
+  var z = last.substring(i);
+  last = z;
+  cache.push(z);
+  offset += i;
+}
+for (var i = 63; i >= 0; i--) {
+  var z = cache.pop();
+  assertTrue(/\u2028123456789ABCDEF/.test(z));
+  assertEquals(xl - offset, z.length);
+  offset -= i;
+}