deps: V8: cherry-pick cca9ae3c9a

Original commit message:

    Remove recursion from NeedsCheckHeapObject.

    We use the predicate NeedsCheckHeapObject in the compiler frontend to
    determine whether we can skip introducing CheckHeapObject nodes. But
    this predicate would also walk up the graph in case of Phis, which can
    result in really long compilation times (on the main thread). In the
    report in nodejs#27667, the compiler
    frontend alone took around 4-5mins of main thread time for a single
    function. With this patch the time goes down to 4-5ms.

    Bug: v8:9250
    Refs: nodejs#27667
    Change-Id: I231eb780ff04f949fa1669714f9af6ebfbcade05
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612897
    Reviewed-by: Jaroslav Sevcik <[email protected]>
    Commit-Queue: Benedikt Meurer <[email protected]>
    Cr-Commit-Position: refs/heads/master@{#61503}

Fixes: nodejs#27667

Backport-PR-URL: nodejs#28005
PR-URL: nodejs#27729
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: James M Snell <[email protected]>

common.gypi

@@ -38,7 +38,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.4',
+    'v8_embedder_string': '-node.5',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/src/compiler/property-access-builder.cc

@@ -119,14 +119,6 @@ bool NeedsCheckHeapObject(Node* receiver) {
     case IrOpcode::kJSToString:
     case IrOpcode::kTypeOf:
       return false;
-    case IrOpcode::kPhi: {
-      Node* control = NodeProperties::GetControlInput(receiver);
-      if (control->opcode() != IrOpcode::kMerge) return true;
-      for (int i = 0; i < receiver->InputCount() - 1; ++i) {
-        if (NeedsCheckHeapObject(receiver->InputAt(i))) return true;
-      }
-      return false;
-    }
     default:
       return true;
   }