[turbofan] Add a missing object to the broker

Bug: chromium:1003730
Change-Id: Id8ca302b0b17ce08821507bb686bf241416eee67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1806913
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63789}

src/compiler/js-heap-broker.cc

@@ -2481,6 +2481,7 @@ void JSHeapBroker::InitializeAndStartSerializing(
   GetOrCreateData(f->fixed_double_array_map());
   GetOrCreateData(f->function_context_map());
   GetOrCreateData(f->function_string());
+  GetOrCreateData(f->has_instance_symbol());
   GetOrCreateData(f->heap_number_map());
   GetOrCreateData(f->length_string());
   GetOrCreateData(f->many_closures_cell_map());

test/mjsunit/regress/regress-1003730.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --concurrent-inlining
+
+function bar(error) {
+  try {
+    throw "didn't throw TypeError";
+  } catch (err) {
+    error instanceof error, "didn't throw " + error.prototype.name;
+  }
+}
+function foo(param) {
+  bar(TypeError);
+}
+try {
+  bar();
+} catch (e) {}
+%PrepareFunctionForOptimization(foo);
+try {
+  foo();
+} catch (e) {}
+%OptimizeFunctionOnNextCall(foo);
+foo();