Merge bleeding edge up to 9192 into the GC branch.

test/mjsunit/substr.js

Index: test/mjsunit/substr.js
diff --git a/test/mjsunit/substr.js b/test/mjsunit/substr.js
index f69a9c045c9aaec793ebb71ea162f9244accd05c..cab8b1bf6dec00373ff13723ab71f2281ab0a494 100755
--- a/test/mjsunit/substr.js
+++ b/test/mjsunit/substr.js
@@ -55,7 +55,7 @@ assertEquals(s, s.substr(-100));
 assertEquals('abc', s.substr(-100, 3));
 assertEquals(s1, s.substr(-s.length + 1));
 
-// assertEquals('', s.substr(0, void 0)); // smjs and rhino 
+// assertEquals('', s.substr(0, void 0)); // smjs and rhino
 assertEquals('abcdefghijklmn', s.substr(0, void 0));  // kjs and v8
 assertEquals('', s.substr(0, null));
 assertEquals(s, s.substr(0, String(s.length)));
@@ -135,3 +135,20 @@ for (var i = 0; i < 10000; i++) {
   assertEquals(xl - (i % xl), z.length);
   cache.push(z);
 }
+
+// Substring of substring.
+var cache = [];
+var last = x;
+var offset = 0;
+for (var i = 0; i < 64; i++) {
+  var z = last.substring(i);
+  last = z;
+  cache.push(z);
+  offset += i;
+}
+for (var i = 63; i >= 0; i--) {
+  var z = cache.pop();
+  assertTrue(/\u2028123456789ABCDEF/.test(z));
+  assertEquals(xl - offset, z.length);
+  offset -= i;
+}