[builtins] fix String.prototype.indexOf with negative indices

test/mjsunit/string-indexof-1.js

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 226 matching lines @@
   assertEquals(0, f3());
 
   function f4() {
     return 'abcbc'.indexOf('bc', 2);
   }
   assertEquals(3, f4());
   assertEquals(3, f4());
   assertEquals(3, f4());
   % OptimizeFunctionOnNextCall(f4);
   assertEquals(3, f4());
+
+  function f5() {
+    return 'abcbc'.indexOf('b', -1);
+  }
+  assertEquals(1, f5());
+  assertEquals(1, f5());
+  assertEquals(1, f5());
+  % OptimizeFunctionOnNextCall(f5);
+  assertEquals(1, f5());
+
+  function f6() {
+    return 'abcbc'.indexOf('b', -10737418);
+  }
+  assertEquals(1, f6());
+  assertEquals(1, f6());
+  assertEquals(1, f6());
+  % OptimizeFunctionOnNextCall(f6);
+  assertEquals(1, f6());
 })();
 
 (function optimizeOSR() {
   function f() {
     var result;
     for (var i = 0; i < 100000; i++) {
       result = 'abc'.indexOf('a');
     }
     return result;
   }
@@ skipping 19 matching lines @@
 
   function f4() {
     var result;
     for (var i = 0; i < 100000; i++) {
       result = 'abcbc'.indexOf('bc', 2);
     }
     return result;
   }
   assertEquals(3, f4());
 })();