Return false in TryNumberToSize if there is a cast error

src/conversions-inl.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_CONVERSIONS_INL_H_
 #define V8_CONVERSIONS_INL_H_
 
 #include <float.h>         // Required for DBL_MAX and on Win32 for finite()
 #include <limits.h>        // Required for INT_MAX etc.
 #include <stdarg.h>
@@ skipping 136 matching lines @@
     DCHECK(static_cast<unsigned>(Smi::kMaxValue) <=
            std::numeric_limits<size_t>::max());
     if (value >= 0) {
       *result = static_cast<size_t>(value);
       return true;
     }
     return false;
   } else {
     DCHECK(number->IsHeapNumber());
     double value = HeapNumber::cast(number)->value();
-    if (value >= 0 && value <= std::numeric_limits<size_t>::max()) {
+    // If value is compared directly to the limit, the limit will be
+    // casted to a double and could end up as limit + 1,
+    // because a double might not have enough mantissa bits for it.
+    // So we might as well cast the limit first, and use < instead of <=.
+    double maxSize = static_cast<double>(std::numeric_limits<size_t>::max());
+    if (value >= 0 && value < maxSize) {
       *result = static_cast<size_t>(value);
       return true;
     } else {
       return false;
     }
   }
 }
 
 size_t NumberToSize(Object* number) {
   size_t result = 0;
@@ skipping 597 matching lines @@
   buffer[buffer_pos] = '\0';
 
   double converted = Strtod(Vector<const char>(buffer, buffer_pos), exponent);
   return (sign == NEGATIVE) ? -converted : converted;
 }
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_CONVERSIONS_INL_H_