Correctly handle negative codes in String.fromCharCode()

test/mjsunit/regress/regress-166553.js

Index: test/mjsunit/regress/regress-166553.js
diff --git a/test/mjsunit/elements-length-no-holey.js b/test/mjsunit/regress/regress-166553.js
similarity index 91%
copy from test/mjsunit/elements-length-no-holey.js
copy to test/mjsunit/regress/regress-166553.js
index 5bac296e1a65f51d9cdfa8406a7c0cb50f937a33..acaf34f4e06011ab5b28e1ce43f79f8fdac5e0aa 100644
--- a/test/mjsunit/elements-length-no-holey.js
+++ b/test/mjsunit/regress/regress-166553.js
@@ -25,9 +25,9 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --expose_gc
 
-a = [1,2,3];
-a.length = 1;
-assertFalse(%HasFastHoleyElements(a));
-assertTrue(%HasFastSmiElements(a));
+JSON.stringify(String.fromCharCode(1, -11).toString())
+gc();
+var s = String.fromCharCode(1, -11)
+assertEquals(65525, s.charCodeAt(1))