Fix stack capture on overflow for Error.stackTraceLimit == Infinity

src/isolate.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 
 #include "src/v8.h"
 
 #include "src/ast.h"
 #include "src/bootstrapper.h"
@@ skipping 774 matching lines @@
       this, js_builtins_object(), "$Error").ToHandleChecked();
   if (!error->IsJSObject()) return heap()->exception();
 
   Handle<String> stackTraceLimit =
       factory()->InternalizeUtf8String("stackTraceLimit");
   ASSERT(!stackTraceLimit.is_null());
   Handle<Object> stack_trace_limit =
       JSObject::GetDataProperty(Handle<JSObject>::cast(error),
                                 stackTraceLimit);
   if (!stack_trace_limit->IsNumber()) return heap()->exception();
-  double dlimit = stack_trace_limit->Number();
-  int limit = std::isnan(dlimit) ? 0 : static_cast<int>(dlimit);
-
+  int limit = FastD2IChecked(stack_trace_limit->Number());
+  if (limit < 0) limit = 0;
   Handle<JSArray> stack_trace = CaptureSimpleStackTrace(
       exception, factory()->undefined_value(), limit);
   JSObject::SetHiddenProperty(exception,
                               factory()->hidden_stack_trace_string(),
                               stack_trace);
   return heap()->exception();
 }
 
 
 Object* Isolate::TerminateExecution() {
@@ skipping 1542 matching lines @@
   // The simulator uses a separate JS stack.
   Address jssp_address = Simulator::current(isolate_)->get_sp();
   uintptr_t jssp = reinterpret_cast<uintptr_t>(jssp_address);
   if (jssp < stack_guard->real_jslimit()) return true;
 #endif  // USE_SIMULATOR
   return reinterpret_cast<uintptr_t>(this) < stack_guard->real_climit();
 }
 
 
 } }  // namespace v8::internal