[turbofan] Fix wrong serialization for Function.bind

Bug: v8:7790
Change-Id: I31502a8023564e88e0a28a421e3c7fb3404847dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722566
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62973}

test/mjsunit/regress/regress-bind-deoptimize.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+(function() {
+  function bla(x) {
+    return this[x];
+  }
+
+  function foo(f) {
+    return bla.bind(f())(0);
+  };
+
+  %PrepareFunctionForOptimization(foo);
+  foo(() => { return [true]; });
+  foo(() => { return [true]; });
+  %OptimizeFunctionOnNextCall(foo);
+  foo(() => { return [true]; });
+  assertOptimized(foo);
+  foo(() => { bla.a = 1; return [true]; });
+  assertUnoptimized(foo);
+})();