[turbofan] Manually serialize descriptors for a field type dependency

It wasn't always guaranteed that they were serialized before taking the
dependency.

Bug: chromium:940361
Change-Id: Id5e5e14532809e7496546c2011176e33848506ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1514495Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60156}

src/compiler/js-call-reducer.cc

@@ -7070,15 +7070,14 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
 
     // Protect the exec method change in the holder.
     Handle<Object> exec_on_proto;
-    Handle<Map> holder_map(holder->map(), isolate());
-    Handle<DescriptorArray> descriptors(holder_map->instance_descriptors(),
-                                        isolate());
+    MapRef holder_map(broker(), handle(holder->map(), isolate()));
+    Handle<DescriptorArray> descriptors(
+        holder_map.object()->instance_descriptors(), isolate());
     int descriptor_index =
-        descriptors->Search(*(factory()->exec_string()), *holder_map);
+        descriptors->Search(*(factory()->exec_string()), *holder_map.object());
     CHECK_NE(descriptor_index, DescriptorArray::kNotFound);
-
-    dependencies()->DependOnFieldType(MapRef(broker(), holder_map),
-                                      descriptor_index);
+    holder_map.SerializeOwnDescriptors();
+    dependencies()->DependOnFieldType(holder_map, descriptor_index);
   } else {
     return NoChange();
   }

test/mjsunit/regress/regress-940361.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const re = /abc/;
+
+// Move the test method one prototype up.
+re.__proto__.__proto__.test = re.__proto__.test;
+delete re.__proto__.test;
+
+function foo(s) {
+  return re.test(s);
+}
+
+assertTrue(foo('abc'));
+assertTrue(foo('abc'));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo('abc'));
+assertFalse(foo('ab'));