[builtins] fix String.prototype.indexOf with negative indices

src/builtins/builtins-string.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-regexp.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/regexp/regexp-utils.h"
@@ skipping 814 matching lines @@
   CSA_ASSERT(this, TaggedIsSmi(position));
 
   Label zero_length_needle(this), call_runtime_unchecked(this),
       return_minus_1(this), check_search_string(this), continue_fast_path(this);
 
   Node* needle_length = SmiUntag(LoadStringLength(search_string));
   // Use faster/complex runtime fallback for long search strings.
   GotoIf(IntPtrLessThan(IntPtrConstant(1), needle_length),
          &call_runtime_unchecked);
   Node* string_length = SmiUntag(LoadStringLength(receiver));
-  Node* start_position = SmiUntag(position);
+  Node* start_position = IntPtrMax(SmiUntag(position), IntPtrConstant(0));
 
   GotoIf(IntPtrEqual(IntPtrConstant(0), needle_length), &zero_length_needle);
   // Check that the needle fits in the start position.
   GotoUnless(IntPtrLessThanOrEqual(needle_length,
                                    IntPtrSub(string_length, start_position)),
              &return_minus_1);
   // Only support one-byte strings on the fast path.
   BranchIfSimpleOneByteStringInstanceType(instance_type, &check_search_string,
                                           &call_runtime_unchecked);
   Bind(&check_search_string);
@@ skipping 87 matching lines @@
     search_string.Bind(arguments.AtIndex(0));
     position.Bind(SmiConstant(0));
     Goto(&fast_path);
   }
   Bind(&argc_2);
   {
     Comment("2 Argument case");
     search_string.Bind(arguments.AtIndex(0));
     position.Bind(arguments.AtIndex(1));
     GotoUnless(TaggedIsSmi(position.value()), &call_runtime);
-    position.Bind(SmiMax(position.value(), SmiConstant(0)));
     Goto(&fast_path);
   }
 
   Bind(&fast_path);
   {
     Comment("Fast Path");
     GotoIf(TaggedIsSmi(receiver), &call_runtime);
     Node* needle = search_string.value();
     GotoIf(TaggedIsSmi(needle), &call_runtime);
 
@@ skipping 920 matching lines @@
         CallRuntime(Runtime::kThrowIncompatibleMethodReceiver, context,
                     HeapConstant(factory()->NewStringFromAsciiChecked(
                         "String Iterator.prototype.next", TENURED)),
                     iterator);
     Return(result);  // Never reached.
   }
 }
 
 }  // namespace internal
 }  // namespace v8