1) Code in JSCallReducer read a FeedbackCell twice and expected the
   result to be the same.

2) JSInliningHeuristics, in the CheckClosure case, assumed that the
   FeedbackCell contains a FeedbackVector.

Bug: chromium:1248743, v8:7790
Change-Id: I66d6dd5f7a879c2479572e1896dd78aeedd2fa27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160200Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76815}