deps: V8: cherry-pick c5ab3e4f0c5a

Original commit message:

    libstdc++: fix incomplete type in v8::internal::is_subtype<T, U>

    Using std::convertible with incomplete types is UB. However, till
    GCC 12 it was accepted and std::convertible returned false.
    This fails now for e.g. v8::internal::WasmArray. Use
    std::disjunction and std::conjunction instead which are short-
    circuiting, because std::is_base_of<T, T> is already true.

    Bug: chromium:957519
    Change-Id: Ia26643dbdf0fb00d5586c71ae6b18e8d0f3cf96e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4394663
    Commit-Queue: Stephan Hartmann <stha09@googlemail.com>
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#86904}

Refs: v8/v8@c5ab3e4
PR-URL: #47736
Fixes: #47623
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>

deps/v8/src/codegen/tnode.h

@@ -266,8 +266,9 @@ using BuiltinPtr = Smi;
 template <class T, class U>
 struct is_subtype {
   static const bool value =
-      std::is_base_of<U, T>::value || (std::is_same<U, MaybeObject>::value &&
-                                       std::is_convertible<T, Object>::value);
+      std::disjunction<std::is_base_of<U, T>,
+                       std::conjunction<std::is_same<U, MaybeObject>,
+                                        std::is_convertible<T, Object>>>::value;
 };
 template <class T1, class T2, class U>
 struct is_subtype<UnionT<T1, T2>, U> {