[builtins] fix String.prototype.indexOf with negative indices

test/mjsunit/string-indexof-1.js

Index: test/mjsunit/string-indexof-1.js
diff --git a/test/mjsunit/string-indexof-1.js b/test/mjsunit/string-indexof-1.js
index 61473255fbfa88173a584a0a7e3fcfa18e41cb21..d83c784fd13ca1d12b75536cc9f755c046eed74b 100644
--- a/test/mjsunit/string-indexof-1.js
+++ b/test/mjsunit/string-indexof-1.js
@@ -244,6 +244,24 @@ for (var lengthIndex = 0; lengthIndex < lengths.length; lengthIndex++) {
   assertEquals(3, f4());
   % OptimizeFunctionOnNextCall(f4);
   assertEquals(3, f4());
+
+  function f5() {
+    return 'abcbc'.indexOf('b', -1);
+  }
+  assertEquals(1, f5());
+  assertEquals(1, f5());
+  assertEquals(1, f5());
+  % OptimizeFunctionOnNextCall(f5);
+  assertEquals(1, f5());
+
+  function f6() {
+    return 'abcbc'.indexOf('b', -10737418);
+  }
+  assertEquals(1, f6());
+  assertEquals(1, f6());
+  assertEquals(1, f6());
+  % OptimizeFunctionOnNextCall(f6);
+  assertEquals(1, f6());
 })();
 
 (function optimizeOSR() {