Fix bug 1439135 (slicedstring on constring not flat)

Review URL: http://codereview.chromium.org/7809

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -510,6 +510,12 @@ Object* String::Flatten() {
       ASSERT(!ss->buffer()->IsSlicedString());
       Object* ok = String::cast(ss->buffer())->Flatten();
       if (ok->IsFailure()) return ok;
+      // Under certain circumstances (TryFlatten fails in String::Slice)
+      // we can have a cons string under a slice.  In this case we need
+      // to get the flat string out of the cons!
+      if (String::cast(ok)->StringIsConsString()) {
+        ss->set_buffer(ConsString::cast(ok)->first());
+      }
       return this;
     }
     case kConsStringTag: {