[csa] Bailout to the runtime for ToInteger conversion in Array.p.indexOf.

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/elements.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
@@ skipping 2620 matching lines @@
 
   static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                          Handle<JSObject> receiver,
                                          Handle<Object> search_value,
                                          uint32_t start_from, uint32_t length) {
     DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
     DisallowHeapAllocation no_gc;
     FixedArrayBase* elements_base = receiver->elements();
     Object* value = *search_value;
 
+    length = std::min(static_cast<uint32_t>(elements_base->length()), length);
+
     if (start_from >= length) return Just<int64_t>(-1);
 
-    length = std::min(static_cast<uint32_t>(elements_base->length()), length);
-
     if (!value->IsNumber()) {
       return Just<int64_t>(-1);
     }
     if (value->IsNaN()) {
       return Just<int64_t>(-1);
     }
     double numeric_search_value = value->Number();
     FixedDoubleArray* elements = FixedDoubleArray::cast(receiver->elements());
 
     for (uint32_t k = start_from; k < length; ++k) {
@@ skipping 1208 matching lines @@
     insertion_index += len;
   }
 
   DCHECK_EQ(insertion_index, result_len);
   return result_array;
 }
 
 ElementsAccessor** ElementsAccessor::elements_accessors_ = NULL;
 }  // namespace internal
 }  // namespace v8