[compiler] Add missing prototype serialization of bound function map

This is needed for JSCallReducer.

Bug: chromium:1217562
Change-Id: I1f06040a74c393598c134301ba0cf04a46380107
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2945184Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75019}

src/compiler/serializer-for-background-compilation.cc

@@ -2557,6 +2557,15 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
         result_hints->AddVirtualBoundFunction(
             VirtualBoundFunction(bound_target, new_arguments), zone(),
             broker());
+
+        broker()
+            ->target_native_context()
+            .bound_function_with_constructor_map()
+            .SerializePrototype();
+        broker()
+            ->target_native_context()
+            .bound_function_without_constructor_map()
+            .SerializePrototype();
       }
       break;
     case Builtin::kObjectGetPrototypeOf:

test/mjsunit/compiler/regress-1217562.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  foo.bind();
+  foo.__proto__ = class {};
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+foo();
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();