Inconsistent treatment with long negative number

[igor-simoes]

Hello everyone,
I found a bug that could be one case of "inconsistent treatment/check of pre-conditions" with long negative number.

Chakra version: 1.9.0.0
OS: Ubuntu 16.04 x64

Steps to reproduce:

1. Run this code

var buffer = new ArrayBuffer(64);
var view = new DataView(buffer);
view.setInt8(0,0x80);
print(view.getInt8(-1770523502845470856862803727694) === -0x80);

Expected output:
An exception with an invalid or out-of-range index

Actual results:
true

V8, SpiderMonkey and JavascriptCore shows expected results. Chakra always returns the value -128 for a long negative number on getInt8 function, note that converting -0x80 to decimal value we obtain -128 too.

cinfuzz

[rhuanjl]

All the get and set methods in DataView.cpp seem to use ToUInt32 on the offset argument they're provided, per spec looks like they should use toIndex https://tc39.github.io/ecma262/#sec-toindex which would throw range errors for any negative.

I'll make a PR to fix this.