[turbofan] Teach serializer about new JumpIfUndefinedOrNull bytecodes

R=mvstanton@chromium.org

Bug: chromium:992684, v8:7790
Change-Id: Ia5e77873f4b96d9f6d9a1468a83a64206f1498ee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1748692Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63180}

src/compiler/serializer-for-background-compilation.cc

@@ -124,7 +124,9 @@ namespace compiler {
   V(JumpIfTrue)                   \
   V(JumpIfTrueConstant)           \
   V(JumpIfUndefined)              \
-  V(JumpIfUndefinedConstant)
+  V(JumpIfUndefinedConstant)      \
+  V(JumpIfUndefinedOrNull)        \
+  V(JumpIfUndefinedOrNullConstant)
 
 #define IGNORED_BYTECODE_LIST(V)      \
   V(CallNoFeedback)                   \

test/mjsunit/compiler/regress-992684.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-lazy-feedback-allocation
+
+function* g(h) {
+  return yield* h;
+}
+
+var f = Object.getPrototypeOf(function*(){}).prototype;
+var t = f.throw;
+const h = (function*(){})();
+h.next = function () { return { }; };
+const x = g(h);
+x.next();
+delete f.throw;
+
+try {
+  t.bind(x)();
+} catch (e) {}
+
+%PrepareFunctionForOptimization(g);
+g();
+%OptimizeFunctionOnNextCall(g);
+g();