[builtins] fix String.prototype.indexOf with negative indices

BUG=689078

Review-Url: https://codereview.chromium.org/2679173002
Cr-Commit-Position: refs/heads/master@{#43016}

src/builtins/builtins-string.cc

@@ -832,7 +832,7 @@ void StringBuiltinsAssembler::StringIndexOf(
   GotoIf(IntPtrLessThan(IntPtrConstant(1), needle_length),
          &call_runtime_unchecked);
   Node* string_length = SmiUntag(LoadStringLength(receiver));
-  Node* start_position = SmiUntag(position);
+  Node* start_position = IntPtrMax(SmiUntag(position), IntPtrConstant(0));
 
   GotoIf(IntPtrEqual(IntPtrConstant(0), needle_length), &zero_length_needle);
   // Check that the needle fits in the start position.
@@ -940,7 +940,6 @@ TF_BUILTIN(StringPrototypeIndexOf, StringBuiltinsAssembler) {
     search_string.Bind(arguments.AtIndex(0));
     position.Bind(arguments.AtIndex(1));
     GotoUnless(TaggedIsSmi(position.value()), &call_runtime);
-    position.Bind(SmiMax(position.value(), SmiConstant(0)));
     Goto(&fast_path);
   }
 

test/mjsunit/string-indexof-1.js

@@ -244,6 +244,24 @@ for (var lengthIndex = 0; lengthIndex < lengths.length; lengthIndex++) {
   assertEquals(3, f4());
   % OptimizeFunctionOnNextCall(f4);
   assertEquals(3, f4());
+
+  function f5() {
+    return 'abcbc'.indexOf('b', -1);
+  }
+  assertEquals(1, f5());
+  assertEquals(1, f5());
+  assertEquals(1, f5());
+  % OptimizeFunctionOnNextCall(f5);
+  assertEquals(1, f5());
+
+  function f6() {
+    return 'abcbc'.indexOf('b', -10737418);
+  }
+  assertEquals(1, f6());
+  assertEquals(1, f6());
+  assertEquals(1, f6());
+  % OptimizeFunctionOnNextCall(f6);
+  assertEquals(1, f6());
 })();
 
 (function optimizeOSR() {