From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Georg Neis <neis@chromium.org>
Date: Thu, 22 Apr 2021 08:50:06 +0200
Subject: Merged: [compiler] Fix off-by-one error in kAdditiveSafeInteger

Revision: 798fbcb0a3e5a292fb775c37c19d9fe73bbac17c

BUG=chromium:1198705
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=nicohartmann@chromium.org

Change-Id: Ifc210e7932f43088e858f6bdac6d9bcdec6e63f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844654
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.0@{#43}
Cr-Branched-From: bd0108b4c88e0d6f2350cb79b5f363fbd02f3eb7-refs/heads/9.0.257@{#1}
Cr-Branched-From: 349bcc6a075411f1a7ce2d866c3dfeefc2efa39d-refs/heads/master@{#73001}

diff --git a/src/compiler/type-cache.h b/src/compiler/type-cache.h
index ada95a37219fc01bb01b413b9eb88fcb4c592e98..2ade5f68a3b1d9b0eeb7cac52435b4b224301003 100644
--- a/src/compiler/type-cache.h
+++ b/src/compiler/type-cache.h
@@ -80,7 +80,7 @@ class V8_EXPORT_PRIVATE TypeCache final {
       Type::Union(kPositiveIntegerOrMinusZero, Type::NaN(), zone());
 
   Type const kAdditiveSafeInteger =
-      CreateRange(-4503599627370496.0, 4503599627370496.0);
+      CreateRange(-4503599627370495.0, 4503599627370495.0);
   Type const kSafeInteger = CreateRange(-kMaxSafeInteger, kMaxSafeInteger);
   Type const kAdditiveSafeIntegerOrMinusZero =
       Type::Union(kAdditiveSafeInteger, Type::MinusZero(), zone());