GCTracer::ResetForTesting() invokes the destructor and then uses
placement new to reinitialize GCTracer to its default state.
Unfortunately, the placement new call uses `heap_`, but `heap_` is no
longer valid to access after invoking the destructor.

The fix is to cache the value in a local and then pass the value of the
local to placement new.

Bug: 40222690
Bug: 353960901
Change-Id: I64bce1a995fd648bda167f743a0f9f1ed8b34215
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5727716


Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#95144}