deps: V8: cherry-pick cca9ae3c9a

Original commit message:

    Remove recursion from NeedsCheckHeapObject.

    We use the predicate NeedsCheckHeapObject in the compiler frontend to
    determine whether we can skip introducing CheckHeapObject nodes. But
    this predicate would also walk up the graph in case of Phis, which can
    result in really long compilation times (on the main thread). In the
    report in #27667, the compiler
    frontend alone took around 4-5mins of main thread time for a single
    function. With this patch the time goes down to 4-5ms.

    Bug: v8:9250
    Refs: #27667
    Change-Id: I231eb780ff04f949fa1669714f9af6ebfbcade05
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612897
    Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
    Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#61503}

Fixes: #27667

PR-URL: #27729
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

deps/v8/src/compiler/property-access-builder.cc

@@ -115,14 +115,6 @@ bool NeedsCheckHeapObject(Node* receiver) {
     case IrOpcode::kJSToString:
     case IrOpcode::kTypeOf:
       return false;
-    case IrOpcode::kPhi: {
-      Node* control = NodeProperties::GetControlInput(receiver);
-      if (control->opcode() != IrOpcode::kMerge) return true;
-      for (int i = 0; i < receiver->InputCount() - 1; ++i) {
-        if (NeedsCheckHeapObject(receiver->InputAt(i))) return true;
-      }
-      return false;
-    }
     default:
       return true;
   }