Backport r5553 "Do not invoke indexed interceptor getters for negative indice...

src/stub-cache.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 907 matching lines @@
   Object* value = args[2];
   ASSERT(recv->HasNamedInterceptor());
   PropertyAttributes attr = NONE;
   Object* result = recv->SetPropertyWithInterceptor(name, value, attr);
   return result;
 }
 
 
 Object* KeyedLoadPropertyWithInterceptor(Arguments args) {
   JSObject* receiver = JSObject::cast(args[0]);
+  ASSERT(Smi::cast(args[1])->value() >= 0);
   uint32_t index = Smi::cast(args[1])->value();
   return receiver->GetElementWithInterceptor(receiver, index);
 }
 
 
 Object* StubCompiler::CompileCallInitialize(Code::Flags flags) {
   HandleScope scope;
   int argc = Code::ExtractArgumentsCountFromFlags(flags);
   CallIC::GenerateInitialize(masm(), argc);
   Object* result = GetCodeWithFlags(flags, "CompileCallInitialize");
@@ skipping 186 matching lines @@
   if (!result->IsFailure()) {
     Code* code = Code::cast(result);
     USE(code);
     LOG(CodeCreateEvent(Logger::STUB_TAG, code, "ConstructStub"));
   }
   return result;
 }
 
 
 } }  // namespace v8::internal