deps: cherry-pick baba152 from V8 upstream

Original commit message:

  fix stepping out of across throwing.

  [email protected]
  BUG=v8:5559

  Review-Url: https://codereview.chromium.org/2445233004
  Cr-Commit-Position: refs/heads/master@{nodejs#40549}

Fixes: nodejs#9175

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 5
 #define V8_MINOR_VERSION 1
 #define V8_BUILD_NUMBER 281
-#define V8_PATCH_LEVEL 90
+#define V8_PATCH_LEVEL 91
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/debug/debug.cc

@@ -962,7 +962,7 @@ void Debug::PrepareStepOnThrow() {
     it.Advance();
   }
 
-  if (last_step_action() == StepNext) {
+  if (last_step_action() == StepNext || last_step_action() == StepOut) {
     while (!it.done()) {
       Address current_fp = it.frame()->UnpaddedFP();
       if (current_fp >= thread_local_.target_fp_) break;

deps/v8/test/mjsunit/regress/regress-5559.js

@@ -0,0 +1,38 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+Debug = debug.Debug
+
+var exception = null;
+var break_count = 0;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    print(event_data.sourceLineText());
+    assertTrue(
+        event_data.sourceLineText().indexOf(`Break ${break_count++}.`) > 0);
+    exec_state.prepareStep(Debug.StepAction.StepOut);
+  } catch (e) {
+    exception = e;
+  }
+};
+
+function thrower() {
+  try {
+    debugger;             // Break 0.
+    throw 'error';
+  } catch (err) {
+  }
+}
+
+
+Debug.setListener(listener);
+thrower();
+Debug.setListener(null);  // Break 1.
+
+assertNull(exception);
+assertEquals(2, break_count);