deps: V8: cherry-pick 501482cbc704

Original commit message: Fix ValueDeserializer::ReadDouble() bounds check If end_ is smaller than sizeof(double), the result would wrap around, and lead to an invalid memory access. Refs: #37978 Change-Id: Ibc8ddcb0c090358789a6a02f550538f91d431c1d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2801353 Reviewed-by: Marja Hölttä <[email protected]> Commit-Queue: Marja Hölttä <[email protected]> Cr-Commit-Position: refs/heads/master@{#73800} PR-URL: #38121Fixes: #37978 Refs: v8/v8@501482cbc704 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Jiawen Geng <[email protected]> Reviewed-By: Darshan Sen <[email protected]>

Author: cjihrig

common.gypi

@@ -36,7 +36,7 @@
 
 # Reset this number to 0 on major V8 upgrades.
 # Increment by one for each non-official patch applied to deps/v8.
-'v8_embedder_string': '-node.8',
+'v8_embedder_string': '-node.9',
 
 ##### V8 defaults for Node.js #####
 

deps/v8/src/objects/value-serializer.cc

@@ -1190,7 +1190,8 @@ Maybe<T> ValueDeserializer::ReadZigZag(){
 
 Maybe<double> ValueDeserializer::ReadDouble(){
 // Warning: this uses host endianness.
-if (position_ > end_ - sizeof(double)) return Nothing<double>();
+if (sizeof(double) > static_cast<unsigned>(end_ - position_))
+return Nothing<double>();
 double value;
 base::Memcpy(&value, position_, sizeof(double));
  position_ += sizeof(double);