Fix bug 1439135 (slicedstring on constring not flat)

Review URL: http://codereview.chromium.org/7809

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/objects.cc b/src/objects.cc
index a1722f8..1178b14 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -510,6 +510,12 @@ Object* String::Flatten() {
       ASSERT(!ss->buffer()->IsSlicedString());
       Object* ok = String::cast(ss->buffer())->Flatten();
       if (ok->IsFailure()) return ok;
+      // Under certain circumstances (TryFlatten fails in String::Slice)
+      // we can have a cons string under a slice.  In this case we need
+      // to get the flat string out of the cons!
+      if (String::cast(ok)->StringIsConsString()) {
+        ss->set_buffer(ConsString::cast(ok)->first());
+      }
       return this;
     }
     case kConsStringTag: {

diff --git a/test/mjsunit/bugs/bug-1439135.js b/test/mjsunit/regress/regress-1439135.js
similarity index 100%
rename from test/mjsunit/bugs/bug-1439135.js
rename to test/mjsunit/regress/regress-1439135.js