The regressing change was:

https://chromium-review.googlesource.com/c/v8/v8/+/1090922/17/src/heap/factory.cc

This difference (empty list vs uninitialized) is important for other parts of
the code, mainly JSObject::UnregisterPrototypeUser whose return value depends on
this difference.

Other parts of the CL already talk about + prepare for using
Smi::kZero as a placeholder for "uninitialized" list.

No regression test added since without this bug, the regressesion test doesn't
crash but hangs.

BUG=chromium:903245

Change-Id: Id3efe955fbd7e08cc4048d23c5b519c504f0201c
Reviewed-on: https://chromium-review.googlesource.com/c/1328924Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57383}