chore: cherry-pick 7c299aede5 from v8 (#28901)

Co-authored-by: Electron Bot <electron@github.com>

patches/v8/.patches

@@ -14,4 +14,5 @@ patch_profiler_allow_empty_source_url_for_asm_modules.patch
 cherry-pick-512cd5e179f4.patch
 merged_squashed_multiple_commits.patch
 merged_compiler_fix_a_bug_in_visitspeculativeintegeradditiveop.patch
+merged_compiler_fix_off-by-one_error_in_kadditivesafeinteger.patch
 merged_turbofan_harden_arrayprototypepop_and_arrayprototypeshift.patch

patches/v8/merged_compiler_fix_off-by-one_error_in_kadditivesafeinteger.patch

@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Georg Neis <neis@chromium.org>
+Date: Thu, 22 Apr 2021 08:50:06 +0200
+Subject: Merged: [compiler] Fix off-by-one error in kAdditiveSafeInteger
+
+Revision: 798fbcb0a3e5a292fb775c37c19d9fe73bbac17c
+
+BUG=chromium:1198705
+NOTRY=true
+NOPRESUBMIT=true
+NOTREECHECKS=true
+TBR=nicohartmann@chromium.org
+
+Change-Id: Ifc210e7932f43088e858f6bdac6d9bcdec6e63f5
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844654
+Reviewed-by: Georg Neis <neis@chromium.org>
+Commit-Queue: Georg Neis <neis@chromium.org>
+Cr-Commit-Position: refs/branch-heads/9.0@{#43}
+Cr-Branched-From: bd0108b4c88e0d6f2350cb79b5f363fbd02f3eb7-refs/heads/9.0.257@{#1}
+Cr-Branched-From: 349bcc6a075411f1a7ce2d866c3dfeefc2efa39d-refs/heads/master@{#73001}
+
+diff --git a/src/compiler/type-cache.h b/src/compiler/type-cache.h
+index ada95a37219fc01bb01b413b9eb88fcb4c592e98..2ade5f68a3b1d9b0eeb7cac52435b4b224301003 100644
+--- a/src/compiler/type-cache.h
++++ b/src/compiler/type-cache.h
+@@ -80,7 +80,7 @@ class V8_EXPORT_PRIVATE TypeCache final {
+       Type::Union(kPositiveIntegerOrMinusZero, Type::NaN(), zone());
+
+   Type const kAdditiveSafeInteger =
+-      CreateRange(-4503599627370496.0, 4503599627370496.0);
++      CreateRange(-4503599627370495.0, 4503599627370495.0);
+   Type const kSafeInteger = CreateRange(-kMaxSafeInteger, kMaxSafeInteger);
+   Type const kAdditiveSafeIntegerOrMinusZero =
+       Type::Union(kAdditiveSafeInteger, Type::MinusZero(), zone());