[Turboprop] Fix Arm64 dynamic map deoptimization.

BUG=chromium:1225561

Change-Id: Ia81127e489b6e790d20f73f7a4a047b6808eb81d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3001177
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75536}

src/compiler/backend/arm64/code-generator-arm64.cc

@@ -3397,14 +3397,15 @@ void CodeGenerator::PrepareForDeoptimizationExits(
         __ bind(&jump_deoptimization_or_resume_entry_labels_[j]);
         __ LoadEntryFromBuiltin(Deoptimizer::GetDeoptWithResumeBuiltin(reason),
                                 scratch);
+        __ Jump(scratch);
       }
     } else {
       __ bind(&jump_deoptimization_entry_labels_[i]);
       __ LoadEntryFromBuiltin(Deoptimizer::GetDeoptimizationEntry(kind),
                               scratch);
-    }
       __ Jump(scratch);
     }
+  }
 }
 
 void CodeGenerator::AssembleMove(InstructionOperand* source,

test/mjsunit/regress/regress-1225561.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turboprop --turbo-dynamic-map-checks
+
+function bar(obj) {
+  return Object.getPrototypeOf(obj);
+}
+
+function foo(a, b) {
+  try {
+    a.a;
+  } catch (e) {}
+  try {
+    b[bar()] = 1;
+  } catch (e) {}
+}
+
+var arg = {
+  a: 10,
+};
+
+%PrepareFunctionForOptimization(foo);
+foo(arg);
+%OptimizeFunctionOnNextCall(foo);
+foo();