Fix SEGMAP_ERR by rolling ICU?

Fix Intl.ListFormat long strings cause SEGMAP_ERR
Add slow regression test.

Bug: chromium:1044570
Change-Id: I20e3523832ac3c69e88c11bd530122bbe782ad01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2032712
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66140}

test/intl/intl.status

@@ -39,6 +39,9 @@
 
   # http://crbug/v8/9930
   'date-format/format_range_hour_cycle': [FAIL],
+
+  # Slow tests.
+  'regress-1044570': [PASS, SLOW, NO_VARIANTS],
 }],  # ALWAYS
 
 ['variant == no_wasm_traps', {

test/intl/regress-1044570.js

@@ -0,0 +1,11 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test no crash with array of very long string.
+const num = 0xAFFFFFF;
+const lfm = new Intl.ListFormat();
+const s = 'a'.repeat(num);
+// Ensure the following won't crash. The length will be 0
+// because it will be too long to return correct result.
+assertEquals(0, lfm.format(Array(16).fill(s)).length);