[v10.x] deps: V8: backport b28637b4fe

[bnoordhuis]

Original commit message:

Apply duct-tape to load elimination

Load elimination is running together with to dead code elimination,
the latter of which might eliminate allocations (in particular
FinishRegion nodes). These are treated as alias nodes by load
elimination, and load elimination does not immediatelly learn that
a node has been disconnected. This causes load elimination to access
the inputs of dead code eliminated nodes while resolving renames,
which causes nullptr dereferences.

This CL modifies load elimination to not resolve to a nullptr alias
but simply stop before that.

Change-Id: If4cef061c7c0e25f353727c9e27f790439b0beb5
Bug: chromium:906406
Reviewed-on: https://chromium-review.googlesource.com/c/1346491
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57688}

Fixes: #31484
V8 CI: https://ci.nodejs.org/job/node-test-commit-v8-linux/2819/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/28637/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/28684/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/28708/

[bnoordhuis]

The reporter of #31484 tried out this patch but he's unfortunately still seeing the crash. This PR fixes a crash though - the V8 regression test crashes without the fix and passes with.

I'll update the commit log.

[bnoordhuis]

Closing in favor of #31613. I reviewed load-elimination.cc and there were more places that had the same bug.