[turbofan] Serialize more prototypes.

Bug: chromium:904417, v8:7790
Change-Id: Ie1edc179c88747a2515f2c42b4820ce3126bfe43
Reviewed-on: https://chromium-review.googlesource.com/c/1331478Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57491}

src/compiler/js-call-reducer.cc

@@ -583,6 +583,7 @@ Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
     // Check if we can constant-fold the {candidate_prototype}.
     for (size_t i = 0; i < object_maps.size(); ++i) {
       MapRef object_map(broker(), object_maps[i]);
+      object_map.SerializePrototype();
       if (IsSpecialReceiverInstanceType(object_map.instance_type()) ||
           object_map.has_hidden_prototype() ||
           !object_map.prototype().equals(candidate_prototype)) {

test/mjsunit/regress/regress-904417.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(o) {
+  return o.hello, Object.getPrototypeOf(o);
+}
+
+var y = { __proto__: {}, hello: 44 };
+var z = { hello: 45 };
+
+bar(y);
+bar(z);
+bar(y);
+%OptimizeFunctionOnNextCall(bar);
+bar(y);