deps: backport 3a9bfec from v8 upstream

Original commit message:

	Fix overflow issue in Zone::New

	When requesting a large allocation near the end of the address space,
	the computation could overflow and erroneously *not* grow the Zone
	as required.

	BUG=chromium:606115
	LOG=y

	Review-Url: https://codereview.chromium.org/1930873002
	Cr-Commit-Position: refs/heads/master@{#35903}

PR-URL: nodejs-private/node-private#44
Reviewed-By: Ben Noordhuis <[email protected]>
Reviewed-By: Rod Vagg <[email protected]>

Author: bnoordhuis

deps/v8/src/zone.cc

@@ -83,9 +83,11 @@ void* Zone::New(int size) {
 #else
       size;
 #endif
-
-  if (size_with_redzone > limit_ - position_) {
-     result = NewExpand(size_with_redzone);
+  const uintptr_t limit = reinterpret_cast<uintptr_t>(limit_);
+  const uintptr_t position = reinterpret_cast<uintptr_t>(position_);
+  // position_ > limit_ can be true after the alignment correction above.
+  if (limit < position || size_with_redzone > limit - position) {
+    result = NewExpand(size_with_redzone);
   } else {
      position_ += size_with_redzone;
   }
@@ -202,7 +204,10 @@ Address Zone::NewExpand(int size) {
   // Make sure the requested size is already properly aligned and that
   // there isn't enough room in the Zone to satisfy the request.
   DCHECK(size == RoundDown(size, kAlignment));
-  DCHECK(size > limit_ - position_);
+  DCHECK(limit_ < position_ ||
+         reinterpret_cast<uintptr_t>(limit_) -
+                 reinterpret_cast<uintptr_t>(position_) <
+             size);
 
   // Compute the new segment size. We use a 'high water mark'
   // strategy, where we increase the segment size every time we expand