[builtins] Fix String.prototype.indexOf with negative positions

BUG=chromium:674889

Review-Url: https://codereview.chromium.org/2593593002
Cr-Commit-Position: refs/heads/master@{#41858}

src/builtins/builtins-string.cc

@@ -906,6 +906,7 @@ TF_BUILTIN(StringPrototypeIndexOf, StringBuiltinsAssembler) {
     search_string.Bind(arguments.AtIndex(0));
     position.Bind(arguments.AtIndex(1));
     GotoUnless(TaggedIsSmi(position.value()), &call_runtime);
+    position.Bind(SmiMax(position.value(), SmiConstant(0)));
     Goto(&fast_path);
   }
 

test/mjsunit/string-indexof-1.js

@@ -30,14 +30,25 @@ var s = "test test test";
 assertEquals(0, s.indexOf("t"));
 assertEquals(3, s.indexOf("t", 1));
 assertEquals(5, s.indexOf("t", 4));
+assertEquals(5, s.indexOf("t", 4.1));
+assertEquals(0, s.indexOf("t", 0));
+assertEquals(0, s.indexOf("t", -1));
+assertEquals(0, s.indexOf("t", -1));
+assertEquals(0, s.indexOf("t", -1.1));
+assertEquals(0, s.indexOf("t", -1073741825));
 assertEquals(1, s.indexOf("e"));
 assertEquals(2, s.indexOf("s"));
 
 assertEquals(5, s.indexOf("test", 4));
 assertEquals(5, s.indexOf("test", 5));
 assertEquals(10, s.indexOf("test", 6));
+assertEquals(10, s.indexOf("test", 6.0));
 assertEquals(0, s.indexOf("test", 0));
+assertEquals(0, s.indexOf("test", 0.0));
 assertEquals(0, s.indexOf("test", -1));
+assertEquals(-1, s.indexOf("not found", -1));
+assertEquals(0, s.indexOf("test", -1.0));
+assertEquals(0, s.indexOf("test", -1073741825));
 assertEquals(0, s.indexOf("test"));
 assertEquals(-1, s.indexOf("notpresent"));
 assertEquals(-1, s.indexOf());