Fix DoubleToFloat32 corner case

For a few double value above the max float, we have to round down
to that max float rather than rounding up to infinity.

Bug: chromium:956564
Change-Id: I34be1def5330bd4c3352b792d20dd500f108d9e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585852
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61052}

src/conversions-inl.h

@@ -59,9 +59,24 @@ inline unsigned int FastD2UI(double x) {
 
 
 inline float DoubleToFloat32(double x) {
-  typedef std::numeric_limits<float> limits;
-  if (x > limits::max()) return limits::infinity();
-  if (x < limits::lowest()) return -limits::infinity();
+  using limits = std::numeric_limits<float>;
+  if (x > limits::max()) {
+    // kRoundingThreshold is the maximum double that rounds down to
+    // the maximum representable float. Its mantissa bits are:
+    // 1111111111111111111111101111111111111111111111111111
+    // [<--- float range --->]
+    // Note the zero-bit right after the float mantissa range, which
+    // determines the rounding-down.
+    static const double kRoundingThreshold = 3.4028235677973362e+38;
+    if (x <= kRoundingThreshold) return limits::max();
+    return limits::infinity();
+  }
+  if (x < limits::lowest()) {
+    // Same as above, mirrored to negative numbers.
+    static const double kRoundingThreshold = -3.4028235677973362e+38;
+    if (x >= kRoundingThreshold) return limits::lowest();
+    return -limits::infinity();
+  }
   return static_cast<float>(x);
 }