LibJS: Reject repeat counts above 2^53 - 1 in String.prototype.repeat

Converting the maximum size_t value to a double rounds up to 2^64, so
a count of exactly 2^64 passed the range check and was subsequently
converted to an unsigned type, which is undefined behavior. Compare
against the maximum array-like index instead, which is exactly
representable as a double. Any count above that limit necessarily
exceeds the maximum string length, so it is rejected in any case.

Author: tcl3

Libraries/LibJS/Runtime/StringPrototype.cpp

@@ -824,7 +824,7 @@ JS_DEFINE_NATIVE_FUNCTION(StringPrototype::repeat)
     if (string->is_empty())
         return PrimitiveString::create(vm, Utf16String {});
 
-    if (n > static_cast<double>(NumericLimits<size_t>::max()))
+    if (n > MAX_ARRAY_LIKE_INDEX)
         return vm.throw_completion<RangeError>(ErrorType::StringRepeatCountMustNotOverflow);
 
     auto count = static_cast<size_t>(n);

Tests/LibJS/Runtime/builtins/String/String.prototype.repeat.js

@@ -30,6 +30,10 @@ test("throws correct range errors", () => {
     expect(() => {
         "aa".repeat(0x80000000);
     }).toThrowWithMessage(RangeError, "repeat count must not overflow");
+
+    expect(() => {
+        "foo".repeat(2 ** 64);
+    }).toThrowWithMessage(RangeError, "repeat count must not overflow");
 });
 
 test("UTF-16", () => {