avm2+tests: Fix String.substr with negative second value, add tests

core/src/avm2/globals/string.rs

@@ -575,6 +575,20 @@ fn substr<'gc>(
             .unwrap_or(&Value::Number(0x7fffffff as f64))
             .coerce_to_number(activation)?;
 
+        let len = if len < 0. {
+            if len.is_infinite() {
+                0.
+            } else {
+                let wrapped_around = this.len() as f64 + len;
+                if wrapped_around as usize + start_index >= this.len() {
+                    return Ok("".into());
+                };
+                wrapped_around
+            }
+        } else {
+            len
+        };
+
         let end_index = if len == f64::INFINITY {
             this.len()
         } else {

tests/tests/swfs/avm2/string_substr_negative/output.txt

@@ -0,0 +1,22 @@
+"abcdefg".substr(3, 5)
+defg
+"abcdefg".substr(0, -2)
+abcde
+"abcdefg".substr(1, -2)
+bcdef
+"abcdefg".substr(2, -2)
+
+"abcdefg".substr(1, -4)
+bcd
+"abcdefg".substr(1, -Infinity)
+
+"abcdefg".substr(2, -1)
+
+"abcdefg".substr(2, 9)
+cdefg
+"abcdefg".substr(0, -3)
+abcd
+"abcdefg".substr(2, -7)
+
+"abcdefg".substr(5, -10)
+

tests/tests/swfs/avm2/string_substr_negative/test.toml

@@ -0,0 +1 @@
+num_frames = 1