Avoid calling Map::TransitionToPrototype (which reads and writes the
JS heap) by skipping the JSCallReducer optimization of Function#bind
whenever the receiver has a custom prototype.

Bug: v8:7790
Change-Id: Ie21475c5dc5c53d90c6afae8198837deb40dac8e
Reviewed-on: https://chromium-review.googlesource.com/c/1288631Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56840}