Harden NumberToSize against overflows.

src/v8conversions.h

Index: src/v8conversions.h
diff --git a/src/v8conversions.h b/src/v8conversions.h
index 3a7b5242ab79af659b15e99b0a6d53f967cd91d1..d3da9f8bb86db798e9ca5ad017a197b7bd5240d0 100644
--- a/src/v8conversions.h
+++ b/src/v8conversions.h
@@ -60,10 +60,17 @@ inline size_t NumberToSize(Isolate* isolate,
                            Object* number) {
   SealHandleScope shs(isolate);
   if (number->IsSmi()) {
-    return Smi::cast(number)->value();
+    int value = Smi::cast(number)->value();
+    CHECK_GE(value, 0);
+    ASSERT(
+      static_cast<unsigned>(Smi::kMaxValue)
+        <= std::numeric_limits<size_t>::max());
+    return static_cast<size_t>(value);
   } else {
     ASSERT(number->IsHeapNumber());
     double value = HeapNumber::cast(number)->value();
+    CHECK(value >= 0 &&
+          value <= std::numeric_limits<size_t>::max());
     return static_cast<size_t>(value);
   }
 }