[csa] Bailout to the runtime for ToInteger conversion in Array.p.indexOf.

src/builtins/builtins-array.cc

Index: src/builtins/builtins-array.cc
diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
index 3537b4243572f1805de8d7c5197d88ac6c2ff084..fd2f2d835e2b8708e01408ee1c26bae56df4d4c8 100644
--- a/src/builtins/builtins-array.cc
+++ b/src/builtins/builtins-array.cc
@@ -2048,33 +2048,28 @@ TF_BUILTIN(ArrayIndexOf, CodeStubAssembler) {
 
   Bind(&init_k);
   {
-    Label done(this), init_k_smi(this), init_k_heap_num(this),
-        init_k_zero(this), init_k_n(this);
-    Node* tagged_n = ToInteger(context, start_from);
-
-    Branch(TaggedIsSmi(tagged_n), &init_k_smi, &init_k_heap_num);
+    // For now only deal with undefined and Smis here; we must be really careful
+    // with side-effects from the ToInteger conversion as the side-effects might
+    // render our assumptions about the receiver being a fast JSArray and the
+    // length invalid.
+    Label done(this), init_k_smi(this), init_k_other(this), init_k_zero(this),
+        init_k_n(this);
+    Branch(TaggedIsSmi(start_from), &init_k_smi, &init_k_other);
 
     Bind(&init_k_smi);
     {
-      start_from_var.Bind(SmiUntag(tagged_n));
+      // The fromIndex is a Smi.
+      start_from_var.Bind(SmiUntag(start_from));
       Goto(&init_k_n);
     }
 
-    Bind(&init_k_heap_num);
+    Bind(&init_k_other);
     {
-      Label do_return_not_found(this);
-      // This round is lossless for all valid lengths.
-      Node* fp_len = RoundIntPtrToFloat64(len_var.value());
-      Node* fp_n = LoadHeapNumberValue(tagged_n);
-      GotoIf(Float64GreaterThanOrEqual(fp_n, fp_len), &do_return_not_found);
-      start_from_var.Bind(ChangeInt32ToIntPtr(TruncateFloat64ToWord32(fp_n)));
+      // The fromIndex must be undefined then, otherwise bailout and let the
+      // runtime deal with the full ToInteger conversion.
+      GotoIfNot(IsUndefined(start_from), &call_runtime);
+      start_from_var.Bind(intptr_zero);
       Goto(&init_k_n);
-
-      Bind(&do_return_not_found);
-      {
-        index_var.Bind(intptr_zero);
-        Goto(&return_not_found);
-      }
     }
 
     Bind(&init_k_n);