[v26.x] deps: V8: cherry-pick c21a93ec80d5

[barathraj048]

Original commit message:

[sandbox] Fix JSDispatchTable entry mark-bit erasure

A race condition exists in V8's concurrent marking and deoptimization
logic where Code::SetMarkedForDeoptimization updates a dispatch table
entry without running a write barrier. During concurrent marking, a
background thread's CAS mark can be overwritten by the mutator's blind
store, leading to a live entry being swept.

Fixed: 525686865
Change-Id: I0cebd44b62ad5c16c19d73e5586058b1d2265ee4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8074259
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108583}

Refs: v8/v8@c21a93e
Fixes: #66661

---

Notes for reviewers:

• v26.x is on V8 14.6, which does not include this fix. The patch applied
  cleanly with git am -3. v8_embedder_string bumped to -node.40.
• The follow-up CL 8064734 (CAS loops), which the TODO refers to as the
  complete fix, is not included here.
• No new test: the race is timing-dependent and could not be reproduced
  on demand, and the upstream commit did not add one.
• Tested: build + vcbuild.bat test on Windows x64. All tests pass except
  test-child-process-exec-any-shells-windows, which fails with EACCES on
  the WindowsApps bash.exe app execution alias. It fails the same way on
  a main build (v27.0.0-pre) without this change, so it's
  environment-specific and unrelated.

cc @nodejs/v8

[nodejs-github-bot]

Review requested:

• @nodejs/gyp
• @nodejs/security-wg
• @nodejs/v8-update