Fix Array.prototype.slice with arguments object with negative length.

test/mjsunit/regress/regress-arguments-slice.js

Index: test/mjsunit/regress/regress-arguments-slice.js
diff --git a/test/message/arrow-bare-rest-param.js b/test/mjsunit/regress/regress-arguments-slice.js
similarity index 63%
copy from test/message/arrow-bare-rest-param.js
copy to test/mjsunit/regress/regress-arguments-slice.js
index bd5761f4e8849cba109c8d111f6526f9107c736e..f7cd8c6ec8c27f867353c745754ac3e37ed7ac3f 100644
--- a/test/message/arrow-bare-rest-param.js
+++ b/test/mjsunit/regress/regress-arguments-slice.js
@@ -1,7 +1,8 @@
 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --harmony-rest-parameters
 
-...x => 10
+function f() { return arguments; }
+var o = f();
+o.length = -100;
+Array.prototype.slice.call(o);