The previous fix resolved the register conflict in favor of moving
kInterpreterBytecodeArrayRegister instead of kSpeculationPoisonRegister,
which regressed interpreter performance. This CL resolves the conflict
in favor of moving kSpeculationPoisonRegister.

Bug: v8:11726
Change-Id: I1975c386c758144d6ade12101957ab03ce7aa4c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2886660Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74534}