The stack scanner copies any potentially uninitialized values into a
temporary on the stack. The temporary is supposed to be unpoisoned
before processing.

This fixes an issue where we would pass the wrong address to
unpoisoning.

Bug: chromium:1056170
Change-Id: I8eb1564103d067e72f9de74b71d9ddfc23a68ade
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2130273
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66932}