[turbofan] Add missing objects to the broker

Bug: v8:7790
Change-Id: I1abffc574b1d9964940625b1f15fc4d98f170b7b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1798682
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63710}

src/compiler/js-heap-broker.cc

@@ -2473,6 +2473,7 @@ void JSHeapBroker::InitializeAndStartSerializing(
   GetOrCreateData(f->empty_fixed_array());
   GetOrCreateData(f->empty_string());
   GetOrCreateData(f->eval_context_map());
+  GetOrCreateData(f->exec_string());
   GetOrCreateData(f->false_string());
   GetOrCreateData(f->false_value());
   GetOrCreateData(f->fixed_array_map());
@@ -2485,6 +2486,7 @@ void JSHeapBroker::InitializeAndStartSerializing(
   GetOrCreateData(f->many_closures_cell_map());
   GetOrCreateData(f->minus_zero_value());
   GetOrCreateData(f->name_dictionary_map());
+  GetOrCreateData(f->name_string());
   GetOrCreateData(f->NaN_string());
   GetOrCreateData(f->null_map());
   GetOrCreateData(f->null_string());
@@ -2495,6 +2497,7 @@ void JSHeapBroker::InitializeAndStartSerializing(
   GetOrCreateData(f->optimized_out());
   GetOrCreateData(f->optimized_out_map());
   GetOrCreateData(f->property_array_map());
+  GetOrCreateData(f->prototype_string());
   GetOrCreateData(f->ReflectHas_string());
   GetOrCreateData(f->ReflectGet_string());
   GetOrCreateData(f->sloppy_arguments_elements_map());
@@ -2505,6 +2508,7 @@ void JSHeapBroker::InitializeAndStartSerializing(
   GetOrCreateData(f->termination_exception_map());
   GetOrCreateData(f->the_hole_map());
   GetOrCreateData(f->the_hole_value());
+  GetOrCreateData(f->then_string());
   GetOrCreateData(f->true_string());
   GetOrCreateData(f->true_value());
   GetOrCreateData(f->undefined_map());

src/compiler/serializer-for-background-compilation.cc

@@ -1969,20 +1969,31 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
     case Builtins::kPromiseResolveTrampoline:
       // For JSCallReducer::ReducePromiseInternalResolve and
       // JSNativeContextSpecialization::ReduceJSResolvePromise.
-      if (arguments.size() >= 2) {
-        Hints const& resolution_hints = arguments[1];
+      if (arguments.size() >= 1) {
+        Hints const& resolution_hints =
+            arguments.size() >= 2
+                ? arguments[1]
+                : Hints::SingleConstant(
+                      broker()->isolate()->factory()->undefined_value(),
+                      zone());
         ProcessHintsForPromiseResolve(resolution_hints);
       }
       break;
     case Builtins::kPromiseInternalResolve:
       // For JSCallReducer::ReducePromiseInternalResolve and
       // JSNativeContextSpecialization::ReduceJSResolvePromise.
-      if (arguments.size() >= 3) {
-        Hints const& resolution_hints = arguments[2];
+      if (arguments.size() >= 2) {
+        Hints const& resolution_hints =
+            arguments.size() >= 3
+                ? arguments[2]
+                : Hints::SingleConstant(
+                      broker()->isolate()->factory()->undefined_value(),
+                      zone());
         ProcessHintsForPromiseResolve(resolution_hints);
       }
       break;
     case Builtins::kRegExpPrototypeTest:
+    case Builtins::kRegExpPrototypeTestFast:
       // For JSCallReducer::ReduceRegExpPrototypeTest.
       if (arguments.size() >= 1 &&
           speculation_mode != SpeculationMode::kDisallowSpeculation) {
@@ -2521,6 +2532,10 @@ SerializerForBackgroundCompilation::ProcessMapForNamedPropertyAccess(
       FunctionTemplateInfoRef fti(broker(), access_info.constant());
       if (fti.has_call_code()) fti.SerializeCallCode();
     }
+  } else if (access_info.IsModuleExport()) {
+    // For JSNativeContextSpecialization::BuildPropertyLoad
+    DCHECK(!access_info.constant().is_null());
+    CellRef(broker(), access_info.constant());
   }
 
   // For PropertyAccessBuilder::TryBuildLoadConstantDataField