fix: backport v8 patch for type inference issue (#22428)

* fix: backport v8 patch for type inference issue

* Update .patches

patches/v8/.patches

@@ -8,3 +8,4 @@ workaround_an_undefined_symbol_error.patch
 do_not_export_private_v8_symbols_on_windows.patch
 include_string_in_v8_h.patch
 objects_fix_memory_leak_in_prototypeusers_add.patch
+fix_bug_in_receiver_maps_inference.patch

patches/v8/fix_bug_in_receiver_maps_inference.patch

@@ -0,0 +1,19 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Samuel Attard <[email protected]>
+Date: Thu, 27 Feb 2020 11:47:31 -0800
+Subject: Fix bug in receiver maps inference
+
+Refs: https://chromium-review.googlesource.com/c/v8/v8/+/2062404
+
+diff --git a/src/compiler/node-properties.cc b/src/compiler/node-properties.cc
+index f43a348bb2d5b803270e42f64a3c790c52a3581b..ab4ced69ab60d6078aeb27c3d8b97e87400687ce 100644
+--- a/src/compiler/node-properties.cc
++++ b/src/compiler/node-properties.cc
+@@ -386,6 +386,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMapsUnsafe(
+           // We reached the allocation of the {receiver}.
+           return kNoReceiverMaps;
+         }
++        result = kUnreliableReceiverMaps;  // JSCreate can have side-effect.
+         break;
+       }
+       case IrOpcode::kJSCreatePromise: {