[compiler] Add missing PropertyCellRef serialization

Bug: v8:7790, chromium:1225300
Change-Id: I36ae331db0abb072ebc597b4682c3983a00d8a1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2999084
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75497}

src/compiler/serializer-for-background-compilation.cc

@@ -3003,10 +3003,13 @@ void SerializerForBackgroundCompilation::ProcessMapForNamedPropertyAccess(
   if (lookup_start_object_map.equals(global_proxy.map())) {
     base::Optional<PropertyCellRef> cell = global_object.GetPropertyCell(
         name, SerializationPolicy::kSerializeIfNeeded);
-    if (access_mode == AccessMode::kLoad && cell.has_value()) {
-      result_hints->AddConstant(
-          handle(cell->object()->value(), broker()->isolate()), zone(),
-          broker());
+    if (cell.has_value()) {
+      CHECK(cell->Serialize());
+      if (access_mode == AccessMode::kLoad) {
+        result_hints->AddConstant(
+            handle(cell->object()->value(), broker()->isolate()), zone(),
+            broker());
+      }
     }
   }
 

test/mjsunit/regress/regress-1225300.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --no-lazy-feedback-allocation
+
+var __v_18 = this;
+function __f_3() {
+  __v_18.outSideFunc = __f_6;
+  function __f_6() {
+  }
+}
+%PrepareFunctionForOptimization(__f_3);
+__f_3();
+%OptimizeFunctionOnNextCall(__f_3);
+__f_3();