Merged: [stubs] Fix negative index lookup in hasOwnProperty

src/builtins/builtins-object.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
 #include "src/property-descriptor.h"
 
@@ skipping 28 matching lines @@
 
   Label keyisindex(assembler), if_iskeyunique(assembler);
   assembler->TryToName(key, &keyisindex, &var_index, &if_iskeyunique,
                        &call_runtime);
 
   assembler->Bind(&if_iskeyunique);
   assembler->TryHasOwnProperty(object, map, instance_type, key, &return_true,
                                &return_false, &call_runtime);
 
   assembler->Bind(&keyisindex);
+  // Handle negative keys in the runtime.
+  assembler->GotoIf(assembler->IntPtrLessThan(var_index.value(),
+                                              assembler->IntPtrConstant(0)),
+                    &call_runtime);
   assembler->TryLookupElement(object, map, instance_type, var_index.value(),
                               &return_true, &return_false, &call_runtime);
 
   assembler->Bind(&return_true);
   assembler->Return(assembler->BooleanConstant(true));
 
   assembler->Bind(&return_false);
   assembler->Return(assembler->BooleanConstant(false));
 
   assembler->Bind(&call_runtime);
@@ skipping 1000 matching lines @@
   Node* constructor = assembler->Parameter(Descriptor::kLeft);
   Node* object = assembler->Parameter(Descriptor::kRight);
   Node* context = assembler->Parameter(Descriptor::kContext);
 
   assembler->Return(
       assembler->OrdinaryHasInstance(context, constructor, object));
 }
 
 }  // namespace internal
 }  // namespace v8