[stubs] Fix negative index lookup in hasOwnProperty

src/builtins/builtins-object.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/property-descriptor.h"
 
@@ skipping 30 matching lines @@
 
   Label keyisindex(&assembler), if_iskeyunique(&assembler);
   assembler.TryToName(key, &keyisindex, &var_index, &if_iskeyunique,
                       &call_runtime);
 
   assembler.Bind(&if_iskeyunique);
   assembler.TryHasOwnProperty(object, map, instance_type, key, &return_true,
                               &return_false, &call_runtime);
 
   assembler.Bind(&keyisindex);
+  // Handle negative keys in the runtime.
+  assembler.GotoIf(
+      assembler.IntPtrLessThan(var_index.value(), assembler.IntPtrConstant(0)),
+      &call_runtime);
   assembler.TryLookupElement(object, map, instance_type, var_index.value(),
                              &return_true, &return_false, &call_runtime);
 
   assembler.Bind(&return_true);
   assembler.Return(assembler.BooleanConstant(true));
 
   assembler.Bind(&return_false);
   assembler.Return(assembler.BooleanConstant(false));
 
   assembler.Bind(&call_runtime);
@@ skipping 1008 matching lines @@
 
   Node* constructor = assembler.Parameter(Descriptor::kLeft);
   Node* object = assembler.Parameter(Descriptor::kRight);
   Node* context = assembler.Parameter(Descriptor::kContext);
 
   assembler.Return(assembler.OrdinaryHasInstance(context, constructor, object));
 }
 
 }  // namespace internal
 }  // namespace v8