Bug 861165: IonMonkey: Correct behaviour for JSOP_IN on dense native with negative index. r=bhackett, a=bajaj