fix: backport v8 patch for type inference issue (#22434)

Co-authored-by: Samuel Attard <samuel.r.attard@gmail.com>

patches/v8/.patches

@@ -9,3 +9,4 @@ do_not_export_private_v8_symbols_on_windows.patch
 revert_cleanup_switch_offset_of_to_offsetof_where_possible.patch
 objects_fix_memory_leak_in_prototypeusers_add.patch
 fix_build_deprecated_attirbute_for_older_msvc_versions.patch
+fix_bug_in_receiver_maps_inference.patch

patches/v8/fix_bug_in_receiver_maps_inference.patch

@@ -0,0 +1,19 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Samuel Attard <sattard@slack-corp.com>
+Date: Thu, 27 Feb 2020 11:47:31 -0800
+Subject: Fix bug in receiver maps inference
+
+Refs: https://chromium-review.googlesource.com/c/v8/v8/+/2062404
+
+diff --git a/src/compiler/node-properties.cc b/src/compiler/node-properties.cc
+index f43a348bb2d5b803270e42f64a3c790c52a3581b..ab4ced69ab60d6078aeb27c3d8b97e87400687ce 100644
+--- a/src/compiler/node-properties.cc
++++ b/src/compiler/node-properties.cc
+@@ -386,6 +386,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMapsUnsafe(
+           // We reached the allocation of the {receiver}.
+           return kNoReceiverMaps;
+         }
++        result = kUnreliableReceiverMaps;  // JSCreate can have side-effect.
+         break;
+       }
+       case IrOpcode::kJSCreatePromise: {