[turbofan] Check word32 -> float64 conversion with input type/output truncation.

src/js/math.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 "use strict";
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
@@ skipping 264 matching lines @@
   if (x == 0 || !NUMBER_IS_FINITE(x)) return x;
   return x >= 0 ? CubeRoot(x) : -CubeRoot(-x);
 }
 
 macro NEWTON_ITERATION_CBRT(x, approx)
   (1.0 / 3.0) * (x / (approx * approx) + 2 * approx);
 endmacro
 
 function CubeRoot(x) {
   var approx_hi = MathFloorJS(%_DoubleHi(x) / 3) + 0x2A9F7893;
-  var approx = %_ConstructDouble(approx_hi, 0);
+  var approx = %_ConstructDouble(approx_hi | 0, 0);
   approx = NEWTON_ITERATION_CBRT(x, approx);
   approx = NEWTON_ITERATION_CBRT(x, approx);
   approx = NEWTON_ITERATION_CBRT(x, approx);
   return NEWTON_ITERATION_CBRT(x, approx);
 }
 
 // -------------------------------------------------------------------
 
 %AddNamedProperty(GlobalMath, toStringTagSymbol, "Math", READ_ONLY | DONT_ENUM);
 
@@ skipping 62 matching lines @@
 utils.Export(function(to) {
   to.MathAbs = MathAbs;
   to.MathExp = MathExp;
   to.MathFloor = MathFloorJS;
   to.IntRandom = MathRandomRaw;
   to.MathMax = MathMax;
   to.MathMin = MathMin;
 });
 
 })