Fix out of bounds array access when index is integer and negative
Fix out of bounds array access when index is integer and negative

When the index is a double, the branchTruncateDoubleToUInt takes care of
branching when the index is negative, but when it's an integer we need
to perform that check ourselves.

Without the patch it's rather easy to cause the application to crash.

Change-Id: If908923ddc2077b3fb3dd42350f038ff0072e8e1
Reviewed-by: Mitch Curtis <a74594a5101269175fe1b140badc4c0b6f699d25@digia.com>
Reviewed-by: Lars Knoll <a812617a4072dcbeb80684eca0f369f0083af109@digia.com>

matthewvogt/qtdeclarative,matthewvogt/qtdeclarative,qmlc/qtdeclarative,qmlc/qtdeclarative,qmlc/qtdeclarative,qmlc/qtdeclarative,mgrunditz/qtdeclarative-2d,mgrunditz/qtdeclarative-2d,mgrunditz/qtdeclarative-2d,qmlc/qtdeclarative,mgrunditz/qtdeclarative-2d,mgrunditz/qtdeclarative-2d,mgrunditz/qtdeclarative-2d,qmlc/qtdeclarative,qmlc/qtdeclarative,matthewvogt/qtdeclarative,qmlc/qtdeclarative,matthewvogt/qtdeclarative,matthewvogt/qtdeclarative,matthewvogt/qtdeclarative,matthewvogt/qtdeclarative,matthewvogt/qtdeclarative,mgrunditz/qtdeclarative-2d