[csa] Bailout to the runtime for ToInteger conversion in Array.p.indexOf.

src/elements.cc

Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index 7a12f6606516f78d8ae0a7bffbd54654b0cd84c7..e2dd976f62cfb3212a1028a7348cc27acb64543a 100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -2638,10 +2638,10 @@ class FastDoubleElementsAccessor
     FixedArrayBase* elements_base = receiver->elements();
     Object* value = *search_value;
 
-    if (start_from >= length) return Just<int64_t>(-1);
-
     length = std::min(static_cast<uint32_t>(elements_base->length()), length);
 
+    if (start_from >= length) return Just<int64_t>(-1);
+
     if (!value->IsNumber()) {
       return Just<int64_t>(-1);
     }