[csa] Fix CSA::ToUint32 rounding for negative HeapNumbers

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 
 namespace v8 {
 namespace internal {
@@ skipping 4042 matching lines @@
     {
       var_result.Bind(NonNumberToNumber(context, input));
       Goto(&end);
     }
   }
 
   BIND(&end);
   return var_result.value();
 }
 
+// ES#sec-touint32
 Node* CodeStubAssembler::ToUint32(Node* context, Node* input) {
   Node* const float_zero = Float64Constant(0.0);
   Node* const float_two_32 = Float64Constant(static_cast<double>(1ULL << 32));
 
   Label out(this);
 
   Variable var_result(this, MachineRepresentation::kTagged, input);
 
   // Early exit for positive smis.
   {
@@ skipping 57 matching lines @@
 
     {
       // -Infinity.
       Label next(this);
       Node* const negative_infinity =
           Float64Constant(-1.0 * std::numeric_limits<double>::infinity());
       Branch(Float64Equal(value, negative_infinity), &return_zero, &next);
       BIND(&next);
     }
 
-    // Return floor({input}) mod 2^32 (assuming mod semantics that always return
-    // positive results).
+    // * Let int be the mathematical value that is the same sign as number and
+    //   whose magnitude is floor(abs(number)).
+    // * Let int32bit be int modulo 2^32.
+    // * Return int32bit.
     {
-      Node* x = Float64Floor(value);
+      Node* x = Float64Trunc(value);
       x = Float64Mod(x, float_two_32);
       x = Float64Add(x, float_two_32);
       x = Float64Mod(x, float_two_32);
 
       Node* const result = ChangeFloat64ToTagged(x);
       var_result.Bind(result);
       Goto(&out);
     }
 
     BIND(&return_zero);
@@ skipping 4317 matching lines @@
         formatted.c_str(), TENURED);
     CallRuntime(Runtime::kGlobalPrint, NoContextConstant(),
                 HeapConstant(string));
   }
   CallRuntime(Runtime::kDebugPrint, NoContextConstant(), tagged_value);
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8