The snapshot merges nodes with their back ref if one exists.
The implementation assumed that the back ref state already has its node
set. However it's possible for the node to be set later.
If the node is not set yet, we stash the back ref and update it after
setting the node.

Bug: chromium:1239144
Change-Id: If6e18cdc0e25ff13bd09218791e3f1052ea0dda8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3094009
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76301}