Robustify NewNumberFromSize against int-overflow on cast

src/factory.h

Index: src/factory.h
diff --git a/src/factory.h b/src/factory.h
index 5ef7c0d91013fd01ba5f869437d26f264a6d436b..01a2f7eecf2c2ca0b6c2f857ee267b2f12f304c7 100644
--- a/src/factory.h
+++ b/src/factory.h
@@ -343,7 +343,9 @@ class Factory final {
                                   PretenureFlag pretenure = NOT_TENURED);
   Handle<Object> NewNumberFromSize(size_t value,
                                    PretenureFlag pretenure = NOT_TENURED) {
-    if (Smi::IsValid(static_cast<intptr_t>(value))) {
+    // We can't use Smi::IsValid() here because that operates on a signed
+    // intptr_t, and casting from size_t could create a bogus sign bit.
+    if (value <= static_cast<size_t>(Smi::kMaxValue)) {
       return Handle<Object>(Smi::FromIntptr(static_cast<intptr_t>(value)),
                             isolate());
     }