chore: cherry-pick fe05610f44 and de534edddb from v8

[ppontes]

[M90-LTS][compiler] Fix bug in MachineOperatorReducer::TryMatchWord32Ror

(cherry picked from commit ca386a4b383165ccaed628c19a1366a273fa371e)

Bug: chromium:1234764
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: Ie899f00e9247bdf67b59aa3ebb7def2948ccdb6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3067332
Commit-Queue: Georg Neis neis@chromium.org
Cr-Original-Commit-Position: refs/heads/master@{#76050}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3099688
Reviewed-by: Georg Neis neis@chromium.org
Reviewed-by: Artem Sumaneev asumaneev@google.com
Commit-Queue: Roger Felipe Zanoni da Silva rzanoni@google.com
Cr-Commit-Position: refs/branch-heads/9.0@{#71}
Cr-Branched-From: bd0108b4c88e0d6f2350cb79b5f363fbd02f3eb7-refs/heads/9.0.257@{#1}
Cr-Branched-From: 349bcc6a075411f1a7ce2d866c3dfeefc2efa39d-refs/heads/master@{#73001}

====================================

[M90-LTS][compiler] Harden JSCallReducer::ReduceArrayIteratorPrototypeNext

(cherry picked from commit 65b20a0e65e1078f5dd230a5203e231bec790ab4)

Bug: chromium:1234764
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I5b1053accf77331687939c789b7ed94df1219287
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3067327
Commit-Queue: Georg Neis neis@chromium.org
Cr-Original-Commit-Position: refs/heads/master@{#76052}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3099689
Reviewed-by: Georg Neis neis@chromium.org
Reviewed-by: Artem Sumaneev asumaneev@google.com
Commit-Queue: Roger Felipe Zanoni da Silva rzanoni@google.com
Cr-Commit-Position: refs/branch-heads/9.0@{#73}
Cr-Branched-From: bd0108b4c88e0d6f2350cb79b5f363fbd02f3eb7-refs/heads/9.0.257@{#1}
Cr-Branched-From: 349bcc6a075411f1a7ce2d866c3dfeefc2efa39d-refs/heads/master@{#73001}

Release Notes

Notes: Security: backported fix for CVE-2021-30598.

[zcbenz]

@ppontes backports for 12-x-y and 11-x-y can be automatically created once the backport for 13-x-y is merged.

For example, the fix for chromium issue 1234764, once the backport for 13-x-y is merged #30587, the backports for 12-x-y and 11-x-y will be automatically generated: #30660, #30659. So this backport is already covered by #30660. (Sorry I forgot to update the issue on the new backports).

(Also it seems that I forgot to backport one patch for 1234764.)

[ppontes]

Closing, hadn't noticed #30660.