[turbofan] Skip bounds checks for positive indices only.

src/compiler/simplified-operator-reducer.cc

Index: src/compiler/simplified-operator-reducer.cc
diff --git a/src/compiler/simplified-operator-reducer.cc b/src/compiler/simplified-operator-reducer.cc
index 49b87b22a1aa036f15ccaee3028d6b90131f910c..21a18eacce27eac0b98492bb387fe20c6f8070ce 100644
--- a/src/compiler/simplified-operator-reducer.cc
+++ b/src/compiler/simplified-operator-reducer.cc
@@ -106,7 +106,7 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
         NumericValueMatcher mlength(node->InputAt(2));
         if (mkey.HasValue() && mlength.HasValue()) {
           // Skip the typed array bounds check if key and length are constant.
-          if (mkey.Value() < mlength.Value()) {
+          if (mkey.Value() >= 0 && mkey.Value() < mlength.Value()) {
             access.bounds_check = kNoBoundsCheck;
             node->set_op(simplified()->LoadElement(access));
             return Changed(node);
@@ -122,7 +122,7 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
         NumericValueMatcher mlength(node->InputAt(2));
         if (mkey.HasValue() && mlength.HasValue()) {
           // Skip the typed array bounds check if key and length are constant.
-          if (mkey.Value() < mlength.Value()) {
+          if (mkey.Value() >= 0 && mkey.Value() < mlength.Value()) {
             access.bounds_check = kNoBoundsCheck;
             node->set_op(simplified()->StoreElement(access));
             return Changed(node);