We can ensure that the constructor is set before the map is set on the
JSObject. Setting the constructor remains non-atomic.

Bug: v8:7790
Change-Id: Ie65519f61e29c9bed89bf09f582aa8bd39de1b03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2761199Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73460}