[stubs] Fix negative index lookup in hasOwnProperty

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 
 namespace v8 {
 namespace internal {
@@ skipping 5066 matching lines @@
 
     GotoUnless(UintPtrLessThan(intptr_index, length), &if_oob);
 
     // Check if the element is a double hole, but don't load it.
     LoadFixedDoubleArrayElement(elements, intptr_index, MachineType::None(), 0,
                                 INTPTR_PARAMETERS, if_not_found);
     Goto(if_found);
   }
   Bind(&if_isdictionary);
   {
+    // Negative keys must be converted to property names.
+    GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), if_bailout);
+
     Variable var_entry(this, MachineType::PointerRepresentation());
     Node* elements = LoadElements(object);
     NumberDictionaryLookup<SeededNumberDictionary>(
         elements, intptr_index, if_found, &var_entry, if_not_found);
   }
   Bind(&if_isfaststringwrapper);
   {
     CSA_ASSERT(this, HasInstanceType(object, JS_VALUE_TYPE));
     Node* string = LoadJSValueValue(object);
     CSA_ASSERT(this, IsStringInstanceType(LoadInstanceType(string)));
@@ skipping 3117 matching lines @@
 Node* CodeStubAssembler::IsPromiseHookEnabled() {
   Node* const is_promisehook_enabled =
       Load(MachineType::Uint8(),
            ExternalConstant(
                ExternalReference::is_promisehook_enabled_address(isolate())));
   return WordNotEqual(is_promisehook_enabled, Int32Constant(0));
 }
 
 }  // namespace internal
 }  // namespace v8