Correctly handle negative codes in String.fromCharCode()

src/string.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 806 matching lines @@
   if (n == 1) {
     if (!%_IsSmi(code)) code = ToNumber(code);
     return %_StringCharFromCode(code & 0xffff);
   }
 
   var one_byte = %NewString(n, NEW_ONE_BYTE_STRING);
   var i;
   for (i = 0; i < n; i++) {
     var code = %_Arguments(i);
     if (!%_IsSmi(code)) code = ToNumber(code) & 0xffff;
+    if (code < 0) code = code & 0xffff;
     if (code > 0x7f) break;
     %_OneByteSeqStringSetChar(one_byte, i, code);
   }
   if (i == n) return one_byte;
   one_byte = %TruncateString(one_byte, i);
 
   var two_byte = %NewString(n - i, NEW_TWO_BYTE_STRING);
   for (var j = 0; i < n; i++, j++) {
     var code = %_Arguments(i);
     if (!%_IsSmi(code)) code = ToNumber(code) & 0xffff;
@@ skipping 163 matching lines @@
     "fixed", StringFixed,
     "italics", StringItalics,
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup
   ));
 }
 
 SetUpString();