[scanner] Fix scanner stream creation: Sliced strings can have an underlying thin string.

Bug: chromium:862538
Change-Id: I13a6886f78ee88ca7c69feb0abda6b149a1e423e
Reviewed-on: https://chromium-review.googlesource.com/1133980
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54397}

src/parsing/scanner-character-streams.cc

@@ -564,9 +564,11 @@ Utf16CharacterStream* ScannerStream::For(Isolate* isolate, Handle<String> data,
   if (data->IsSlicedString()) {
     SlicedString* string = SlicedString::cast(*data);
     start_offset = string->offset();
-    data = handle(string->parent(), string->GetIsolate());
+    String* parent = string->parent();
+    if (parent->IsThinString()) parent = ThinString::cast(parent)->actual();
+    data = handle(parent, isolate);
   } else {
-    data = String::Flatten(data->GetIsolate(), data);
+    data = String::Flatten(isolate, data);
   }
   if (data->IsExternalOneByteString()) {
     return new BufferedCharacterStream<uint8_t, ExternalStringStream>(

test/mjsunit/regress/regress-crbug-862538.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var uvwxyzundefined;
+
+function __f_5778(__v_29973) {
+  var __v_29975 = __v_29973 + undefined;
+  var __v_29976 = __v_29975.substring( 20);
+  ({})[__v_29975];
+  return eval(__v_29976);
+}
+__f_5778("abcdefghijklmnopqrstuvwxyz");