Access of forwarded map isn't allowed without synchronization. The fix
is to not invoke IsMap() on the forwarded map. If we would want that we
would need a release-store when setting the forwarding pointer on an
evacuated object.

Bug: chromium:1315622, v8:12578
Change-Id: I2f03c810c39875e565bc769c57452af75849044f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585567Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80003}