Do not invoke indexed interceptor getters for negative indices.

src/stub-cache.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 970 matching lines @@
   Object* value = args[2];
   ASSERT(recv->HasNamedInterceptor());
   PropertyAttributes attr = NONE;
   Object* result = recv->SetPropertyWithInterceptor(name, value, attr);
   return result;
 }
 
 
 Object* KeyedLoadPropertyWithInterceptor(Arguments args) {
   JSObject* receiver = JSObject::cast(args[0]);
+  ASSERT(Smi::cast(args[1])->value() >= 0);
   uint32_t index = Smi::cast(args[1])->value();
   return receiver->GetElementWithInterceptor(receiver, index);
 }
 
 
 Object* StubCompiler::CompileCallInitialize(Code::Flags flags) {
   HandleScope scope;
   int argc = Code::ExtractArgumentsCountFromFlags(flags);
   Code::Kind kind = Code::ExtractKindFromFlags(flags);
   if (kind == Code::CALL_IC) {
@@ skipping 352 matching lines @@
       expected_receiver_type_ =
           FunctionTemplateInfo::cast(signature->receiver());
     }
   }
 
   is_simple_api_call_ = true;
 }
 
 
 } }  // namespace v8::internal