[csa] Fix CSA::ToUint32 rounding for negative HeapNumbers

test/mjsunit/string-split.js

Index: test/mjsunit/string-split.js
diff --git a/test/mjsunit/string-split.js b/test/mjsunit/string-split.js
index e9fc9804b9dbfbd84b5964d345c1ce0243063ea1..8068838ea10b6a9b9a1431f8ecf2068e41214382 100644
--- a/test/mjsunit/string-split.js
+++ b/test/mjsunit/string-split.js
@@ -167,7 +167,9 @@ assertEquals(2, counter);
 
 // Check ToUint32 conversion of limit.
 assertArrayEquals(["a"], "a,b,c,d,e,f".split(/,/, -4294967295));
-assertArrayEquals(["a"], "a,b,c,d,e,f".split(/,/, -4294967294.5));
+assertArrayEquals(["a", "b"], "a,b,c,d,e,f".split(/,/, -4294967294.001));
+assertArrayEquals(["a", "b"], "a,b,c,d,e,f".split(/,/, -4294967294.5));
+assertArrayEquals(["a", "b"], "a,b,c,d,e,f".split(/,/, -4294967294.999));
 assertArrayEquals(["a", "b"], "a,b,c,d,e,f".split(/,/, -4294967294));
 assertArrayEquals(["a", "b", "c"], "a,b,c,d,e,f".split(/,/, -4294967293));
 assertArrayEquals(["a", "b", "c", "d"], "a,b,c,d,e,f".split(/,/, -4294967292));