Treat negative utf8-units the same way as other broken encodings.

sdk/lib/convert/utf.dart

Index: sdk/lib/convert/utf.dart
diff --git a/sdk/lib/convert/utf.dart b/sdk/lib/convert/utf.dart
index 80f7a7837f15ece8586f67385f46b0d3b5f3fd03..37f2335252934ebf2d8f30ef37c549217059d603 100644
--- a/sdk/lib/convert/utf.dart
+++ b/sdk/lib/convert/utf.dart
@@ -455,7 +455,19 @@ class _Utf8Decoder {
 
       while (i < endIndex) {
         int unit = codeUnits[i++];
-        if (unit <= _ONE_BYTE_LIMIT) {
+        // TODO(floitsch): the way we test we could potentially allow
+        // units that are too large, if they happen to have the
+        // right bit-pattern. (Same is true for the multibyte loop above).
+        // TODO(floitsch): optimize this loop. See:
+        // https://codereview.chromium.org/22929022/diff/1/sdk/lib/convert/utf.dart?column_width=80
+        if (unit < 0) {
+          // TODO(floitsch): should this be unit <= 0 ?
+          if (!_allowMalformed) {
+            throw new FormatException(
+                "Negative UTF-8 code unit: -0x${(-unit).toRadixString(16)}");
+          }
+          _stringSink.writeCharCode(_REPLACEMENT_CHARACTER);
+        } else if (unit <= _ONE_BYTE_LIMIT) {
           _isFirstCharacter = false;
           _stringSink.writeCharCode(unit);
         } else {