deps: V8: cherry-pick e061cf9970d9

Original commit message:

    [arraybuffers] initialize max byte length of empty array buffers

    Without initializing the max byte length field, any empty array
    buffer captured in the snapshot can make the snapshot unreproducible.

    Refs: #53579

    Change-Id: I2489ab2e57ecbb405ec431a87d0acc92822b777c
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5662576
    Reviewed-by: Marja Hölttä <marja@chromium.org>
    Commit-Queue: Marja Hölttä <marja@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#94754}

Refs: v8/v8@e061cf9
PR-URL: #53755
Fixes: #53579
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>

common.gypi

@@ -36,7 +36,7 @@
 
  # Reset this number to 0 on major V8 upgrades.
  # Increment by one for each non-official patch applied to deps/v8.
- 'v8_embedder_string': '-node.15',
+ 'v8_embedder_string': '-node.16',
 
  ##### V8 defaults for Node.js #####
 

deps/v8/src/builtins/builtins-typed-array-gen.cc

@@ -68,6 +68,8 @@ TNode<JSArrayBuffer> TypedArrayBuiltinsAssembler::AllocateEmptyOnHeapBuffer(
  UndefinedConstant());
  StoreBoundedSizeToObject(buffer, JSArrayBuffer::kRawByteLengthOffset,
  UintPtrConstant(0));
+ StoreBoundedSizeToObject(buffer, JSArrayBuffer::kRawMaxByteLengthOffset,
+ UintPtrConstant(0));
  StoreSandboxedPointerToObject(buffer, JSArrayBuffer::kBackingStoreOffset,
  EmptyBackingStoreBufferConstant());
 #ifdef V8_COMPRESS_POINTERS