deps: V8: cherry-pick d90d4533b053

Original commit message:

    Fix reading integer-indexed import assertions in dynamic import

    Use GetPropertyOrElement instead of GetProperty to read import assertion
    values from the import assertions object, to support cases in which the
    key is an integer index such as `"0"`.

    The added test case, when using GetProperty, triggers the following DCHECK in
    debug builds:
    https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/lookup-inl.h;l=108;drc=515f187ba067ee4a99fdf5198cca2c97abd342fd
    In release builds it silently fails to read the property, and thus throws about
    it not being a valid string.

    Bug: v8:14069
    Change-Id: Ifd4645b7bd9bfd07f06fa33727441d27eabc4d32
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4614489
    Reviewed-by: Victor Gomes <victorgomes@chromium.org>
    Commit-Queue: Marja Hölttä <marja@chromium.org>
    Reviewed-by: Marja Hölttä <marja@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#88267}

Refs: v8/v8@d90d453
PR-URL: #50077
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Richard Lau <rlau@redhat.com>

common.gypi

@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.35',
+    'v8_embedder_string': '-node.36',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/src/execution/isolate.cc

@@ -4796,8 +4796,8 @@ MaybeHandle<FixedArray> Isolate::GetImportAssertionsFromArgument(
   for (int i = 0; i < assertion_keys->length(); i++) {
     Handle<String> assertion_key(String::cast(assertion_keys->get(i)), this);
     Handle<Object> assertion_value;
-    if (!JSReceiver::GetProperty(this, import_assertions_object_receiver,
-                                 assertion_key)
+    if (!Object::GetPropertyOrElement(this, import_assertions_object_receiver,
+                                      assertion_key)
              .ToHandle(&assertion_value)) {
       // This can happen if the property has a getter function that throws
       // an error.

deps/v8/test/mjsunit/harmony/modules-import-assertions-dynamic-6.mjs

@@ -8,6 +8,11 @@ var life;
 import('modules-skip-1.json', { assert: { type: 'json', notARealAssertion: 'value' } }).then(
     namespace => life = namespace.default.life);
 
+var life2;
+import('modules-skip-1.json', { assert: { 0: 'value', type: 'json' } }).then(
+    namespace => life2 = namespace.default.life);
+
 %PerformMicrotaskCheckpoint();
 
 assertEquals(42, life);
+assertEquals(42, life2);