deps: V8: cherry-pick e8e9c07 from upstream

Original commit message:
  Make sure the heap is in consistent state when calling allocation observers.

  The observer might want to lookup something in the heap, e.g. code objects
  it has in the call stack.

  BUG=v8:4959
  LOG=N

  Review-Url: https://codereview.chromium.org/1948893002
  Cr-Commit-Position: refs/heads/master@{#36027}

Ref: https://bugs.chromium.org/p/v8/issues/detail?id=4959
Ref: v8/v8@e8e9c07

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 5
 #define V8_MINOR_VERSION 1
 #define V8_BUILD_NUMBER 281
-#define V8_PATCH_LEVEL 110
+#define V8_PATCH_LEVEL 111
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/heap/spaces.cc

@@ -2382,7 +2382,6 @@ HeapObject* FreeList::Allocate(int size_in_bytes) {
   int new_node_size = 0;
   FreeSpace* new_node = FindNodeFor(size_in_bytes, &new_node_size);
   if (new_node == nullptr) return nullptr;
-  owner_->AllocationStep(new_node->address(), size_in_bytes);
 
   int bytes_left = new_node_size - size_in_bytes;
   DCHECK(bytes_left >= 0);
@@ -2428,6 +2427,8 @@ HeapObject* FreeList::Allocate(int size_in_bytes) {
                            new_node->address() + new_node_size);
   }
 
+  owner_->AllocationStep(new_node->address(), size_in_bytes);
+
   return new_node;
 }