[csa] Bailout to the runtime for ToInteger conversion in Array.p.indexOf.

src/builtins/builtins-array.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/contexts.h"
@@ skipping 2030 matching lines @@
     CSA_ASSERT(this,
                TaggedIsSmi(LoadObjectField(array, JSArray::kLengthOffset)));
     Node* len = LoadAndUntagObjectField(array, JSArray::kLengthOffset);
 
     len_var.Bind(len);
     Branch(WordEqual(len_var.value(), intptr_zero), &return_not_found, &init_k);
   }
 
   Bind(&init_k);
   {
-    Label done(this), init_k_smi(this), init_k_heap_num(this),
-        init_k_zero(this), init_k_n(this);
-    Node* tagged_n = ToInteger(context, start_from);
-
-    Branch(TaggedIsSmi(tagged_n), &init_k_smi, &init_k_heap_num);
+    // For now only deal with undefined and Smis here; we must be really careful
+    // with side-effects from the ToInteger conversion as the side-effects might
+    // render our assumptions about the receiver being a fast JSArray and the
+    // length invalid.
+    Label done(this), init_k_smi(this), init_k_other(this), init_k_zero(this),
+        init_k_n(this);
+    Branch(TaggedIsSmi(start_from), &init_k_smi, &init_k_other);
 
     Bind(&init_k_smi);
     {
-      start_from_var.Bind(SmiUntag(tagged_n));
+      // The fromIndex is a Smi.
+      start_from_var.Bind(SmiUntag(start_from));
       Goto(&init_k_n);
     }
 
-    Bind(&init_k_heap_num);
+    Bind(&init_k_other);
     {
-      Label do_return_not_found(this);
-      // This round is lossless for all valid lengths.
-      Node* fp_len = RoundIntPtrToFloat64(len_var.value());
-      Node* fp_n = LoadHeapNumberValue(tagged_n);
-      GotoIf(Float64GreaterThanOrEqual(fp_n, fp_len), &do_return_not_found);
-      start_from_var.Bind(ChangeInt32ToIntPtr(TruncateFloat64ToWord32(fp_n)));
+      // The fromIndex must be undefined then, otherwise bailout and let the
+      // runtime deal with the full ToInteger conversion.
+      GotoIfNot(IsUndefined(start_from), &call_runtime);
+      start_from_var.Bind(intptr_zero);
       Goto(&init_k_n);
-
-      Bind(&do_return_not_found);
-      {
-        index_var.Bind(intptr_zero);
-        Goto(&return_not_found);
-      }
     }
 
     Bind(&init_k_n);
     {
       Label if_positive(this), if_negative(this), done(this);
       Branch(IntPtrLessThan(start_from_var.value(), intptr_zero), &if_negative,
              &if_positive);
 
       Bind(&if_positive);
       {
@@ skipping 660 matching lines @@
   {
     Node* message = SmiConstant(MessageTemplate::kDetachedOperation);
     CallRuntime(Runtime::kThrowTypeError, context, message,
                 HeapConstant(operation));
     Unreachable();
   }
 }
 
 }  // namespace internal
 }  // namespace v8