Merged: Fix DoubleToFloat32 corner case

For a few double value above the max float, we have to round down
to that max float rather than rounding up to infinity.

(cherry picked from commit 7265ea973cffa84c9ed43c242fc3f58d7a69bed3)

Bug: chromium:956564
Change-Id: I34be1def5330bd4c3352b792d20dd500f108d9e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585852
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#61052}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588458
Cr-Commit-Position: refs/branch-heads/7.5@{#10}
Cr-Branched-From: 35b9bf5-refs/heads/7.5.288@{#1}
Cr-Branched-From: 912b391-refs/heads/master@{#60911}

src/conversions-inl.h

@@ -59,9 +59,24 @@ inline unsigned int FastD2UI(double x) {
 
 
 inline float DoubleToFloat32(double x) {
-  typedef std::numeric_limits<float> limits;
-  if (x > limits::max()) return limits::infinity();
-  if (x < limits::lowest()) return -limits::infinity();
+  using limits = std::numeric_limits<float>;
+  if (x > limits::max()) {
+    // kRoundingThreshold is the maximum double that rounds down to
+    // the maximum representable float. Its mantissa bits are:
+    // 1111111111111111111111101111111111111111111111111111
+    // [<--- float range --->]
+    // Note the zero-bit right after the float mantissa range, which
+    // determines the rounding-down.
+    static const double kRoundingThreshold = 3.4028235677973362e+38;
+    if (x <= kRoundingThreshold) return limits::max();
+    return limits::infinity();
+  }
+  if (x < limits::lowest()) {
+    // Same as above, mirrored to negative numbers.
+    static const double kRoundingThreshold = -3.4028235677973362e+38;
+    if (x >= kRoundingThreshold) return limits::lowest();
+    return -limits::infinity();
+  }
   return static_cast<float>(x);
 }