[compiler] Fix wrong Node type in escape analysis reducer

Change-Id: Ic973a3f7eb5a73635f32386fffc9f23c1e147256
Bug: chromium:1107879
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2310364
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68987}

src/compiler/escape-analysis-reducer.cc

@@ -319,8 +319,10 @@ void EscapeAnalysisReducer::Finalize() {
             Node* index = NodeProperties::GetValueInput(load, 1);
             Node* formal_parameter_count =
                 jsgraph()->Constant(params.formal_parameter_count());
-            NodeProperties::SetType(formal_parameter_count,
-                                    TypeCache::Get()->kArgumentsLengthType);
+            NodeProperties::SetType(
+                formal_parameter_count,
+                Type::Constant(params.formal_parameter_count(),
+                               jsgraph()->graph()->zone()));
 #ifdef V8_REVERSE_JSARGS
             Node* offset_to_first_elem = jsgraph()->Constant(
                 CommonFrameConstants::kFixedSlotCountAboveFp);