deps: V8: cherry-pick d90d4533b053

Original commit message:

    Fix reading integer-indexed import assertions in dynamic import

    Use GetPropertyOrElement instead of GetProperty to read import assertion
    values from the import assertions object, to support cases in which the
    key is an integer index such as `"0"`.

    The added test case, when using GetProperty, triggers the following DCHECK in
    debug builds:
    https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/lookup-inl.h;l=108;drc=515f187ba067ee4a99fdf5198cca2c97abd342fd
    In release builds it silently fails to read the property, and thus throws about
    it not being a valid string.

    Bug: v8:14069
    Change-Id: Ifd4645b7bd9bfd07f06fa33727441d27eabc4d32
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4614489
    Reviewed-by: Victor Gomes <[email protected]>
    Commit-Queue: Marja Hölttä <[email protected]>
    Reviewed-by: Marja Hölttä <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#88267}

Refs: v8/v8@d90d453
PR-URL: #50077
Reviewed-By: Ben Noordhuis <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Mohammed Keyvanzadeh <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

common.gypi

@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.35',
+    'v8_embedder_string': '-node.36',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/src/execution/isolate.cc

@@ -4796,8 +4796,8 @@ MaybeHandle<FixedArray> Isolate::GetImportAssertionsFromArgument(
   for (int i = 0; i < assertion_keys->length(); i++) {
     Handle<String> assertion_key(String::cast(assertion_keys->get(i)), this);
     Handle<Object> assertion_value;
-    if (!JSReceiver::GetProperty(this, import_assertions_object_receiver,
-                                 assertion_key)
+    if (!Object::GetPropertyOrElement(this, import_assertions_object_receiver,
+                                      assertion_key)
              .ToHandle(&assertion_value)) {
       // This can happen if the property has a getter function that throws
       // an error.

deps/v8/test/mjsunit/harmony/modules-import-assertions-dynamic-6.mjs

@@ -8,6 +8,11 @@ var life;
 import('modules-skip-1.json', { assert: { type: 'json', notARealAssertion: 'value' } }).then(
     namespace => life = namespace.default.life);
 
+var life2;
+import('modules-skip-1.json', { assert: { 0: 'value', type: 'json' } }).then(
+    namespace => life2 = namespace.default.life);
+
 %PerformMicrotaskCheckpoint();
 
 assertEquals(42, life);
+assertEquals(42, life2);