[compiler] Eliminate non-determinism in element access code gen

Replace a ZoneUnorderedMap with a ZoneMap in order to avoid
non-deterministic iteration order resulting in non-deterministic IR
and non-deterministic allocations during code assembly later. The
map in question is very small in practice so there should be no
performance regression.

Bug: v8:11894
Change-Id: Ic961102b45b3df28dafdece0cfb54ff5ef940d56
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3001348Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75529}

src/compiler/js-heap-broker.cc

@@ -1001,9 +1001,12 @@ ElementAccessFeedback const& JSHeapBroker::ProcessFeedbackMapsForElementAccess(
   }
 
   using TransitionGroup = ElementAccessFeedback::TransitionGroup;
-  ZoneUnorderedMap<Handle<Map>, TransitionGroup, Handle<Map>::hash,
-                   Handle<Map>::equal_to>
-      transition_groups(zone());
+  struct HandleLess {
+    bool operator()(Handle<Map> x, Handle<Map> y) const {
+      return x.address() < y.address();
+    }
+  };
+  ZoneMap<Handle<Map>, TransitionGroup, HandleLess> transition_groups(zone());
 
   // Separate the actual receiver maps and the possible transition sources.
   for (Handle<Map> map : maps) {