Return false in TryNumberToSize if there is a cast error

src/conversions-inl.h

Index: src/conversions-inl.h
diff --git a/src/conversions-inl.h b/src/conversions-inl.h
index 427a67d1097b717facd06be847bdc85e11a5e53c..2086f8184a1d212c8555d7d0fa4b24900be03fa7 100644
--- a/src/conversions-inl.h
+++ b/src/conversions-inl.h
@@ -154,7 +154,12 @@ bool TryNumberToSize(Object* number, size_t* result) {
   } else {
     DCHECK(number->IsHeapNumber());
     double value = HeapNumber::cast(number)->value();
-    if (value >= 0 && value <= std::numeric_limits<size_t>::max()) {
+    // If value is compared directly to the limit, the limit will be
+    // casted to a double and could end up as limit + 1,
+    // because a double might not have enough mantissa bits for it.
+    // So we might as well cast the limit first, and use < instead of <=.
+    double maxSize = static_cast<double>(std::numeric_limits<size_t>::max());
+    if (value >= 0 && value < maxSize) {
       *result = static_cast<size_t>(value);
       return true;
     } else {