[date] Fix double-to-int conversion in MakeDay

`date` could be outside the int32_t range and thus FastD2I may not be
used.

Bug: chromium:849663
Change-Id: I96a012b40d35ec8f80e449e4e687b0ce7b572d5e
Reviewed-on: https://chromium-review.googlesource.com/1087063Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53526}

src/builtins/builtins-date.cc

@@ -47,7 +47,6 @@ double MakeDay(double year, double month, double date) {
       (kMinMonth <= month && month <= kMaxMonth) && std::isfinite(date)) {
     int y = FastD2I(year);
     int m = FastD2I(month);
-    int dt = FastD2I(date);
     y += m / 12;
     m %= 12;
     if (m < 0) {
@@ -81,7 +80,7 @@ double MakeDay(double year, double month, double date) {
                                           182, 213, 244, 274, 305, 335};
       day_from_year += kDayFromMonth[m];
     }
-    return static_cast<double>(day_from_year - 1 + dt);
+    return static_cast<double>(day_from_year - 1) + DoubleToInteger(date);
   }
   return std::numeric_limits<double>::quiet_NaN();
 }

test/mjsunit/regress/regress-849663.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const v1 = 0xFFFFFFFF;
+const v3 = new Float64Array();
+new Date(v3, v3, 0xFFFFFFFF,);