Fix double to integer conversions in runtime string indexing.

Review URL: http://codereview.chromium.org/2577001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4791 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/runtime.cc

@@ -1665,7 +1665,7 @@ static Object* Runtime_StringCharCodeAt(Arguments args) {
   } else {
     ASSERT(index->IsHeapNumber());
     double value = HeapNumber::cast(index)->value();
-    i = static_cast<uint32_t>(value);
+    i = static_cast<uint32_t>(DoubleToInteger(value));
   }
 
   // Flatten the string.  If someone wants to get a char at an index

test/mjsunit/string-charat.js

@@ -48,6 +48,7 @@ function basicTest(s, len) {
   assertEquals("", s().charAt(-1/0));
   assertEquals("t", s().charAt(0));
   assertEquals("t", s().charAt(-0.0));
+  assertEquals("t", s().charAt(-0.1));
   assertEquals("t", s().charAt(0.4));
   assertEquals("e", s().charAt(slowIndex1));
   assertEquals("s", s().charAt(slowIndex2));
@@ -63,6 +64,7 @@ function basicTest(s, len) {
   assertEquals(101, s().charCodeAt(true));
   assertEquals(116, s().charCodeAt(0));
   assertEquals(116, s().charCodeAt(-0.0));
+  assertEquals(116, s().charCodeAt(-0.1));
   assertEquals(116, s().charCodeAt(0.4));
   assertEquals(101, s().charCodeAt(slowIndex1));
   assertEquals(115, s().charCodeAt(slowIndex2));