[Intl] Fix ASAN crash listformat w/ > 9 items

Fix the ASAN crahs when there are 9 or more items to be formatted by
ListFormat.

chromium DEPS rolled in
https://chromium-review.googlesource.com/c/chromium/src/+/2536432

This CL is mainly to add unit test to ensure it fix.

Cq-Include-Trybots: luci.v8.try:v8_linux64_asan_rel_ng,v8_mac64_asan_rel_ng,v8_win64_asan_rel_ng;luci.chromium.try:android-asan,win-asan,win-libfuzzer-asan-relBug: chromium:1146068
Change-Id: I4dfbd6ea0efe5b398196f95abc520bb93e16a7cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2528476Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71192}

test/intl/regress-1012579.js

-// Copyright 2019 the V8 project authors. All rights reserved.
+// Copyright 2020 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-let longLocale = 'de-u-cf-cu-em-kk-kr-ks-kv-lb-lw-ms-nu-rg-sd-ss-tz';
-rtf = new Intl.RelativeTimeFormat(longLocale);
+// Verify won't crash in ListFormat
+//            1    2    3    4    5    6    7    8    9
+var list = [ 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i'];
+const lf = new Intl.ListFormat();
+const parts = lf.formatToParts(list);