[compiler] Take stability dependency on primitive wrapper map

The stability dependency should be taken on the primitive wrapper map,
not the primitive map (which is guaranteed to remain stable).

Note that the primitive wrapper map itself *also* stays stable; but
changing the position of the call here avoids having to think deeply
about this at all in the future.

Bug: v8:7790
Change-Id: I9b79b9df0d8d49f0c6249c6cd906142bda1ff5cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3053578Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75906}

src/compiler/compilation-dependencies.cc

@@ -873,7 +873,6 @@ void CompilationDependencies::DependOnStablePrototypeChains(
     ZoneVector<MapRef> const& receiver_maps, WhereToStart start,
     base::Optional<JSObjectRef> last_prototype) {
   for (MapRef receiver_map : receiver_maps) {
-    if (start == kStartAtReceiver) DependOnStableMap(receiver_map);
     if (receiver_map.IsPrimitiveMap()) {
       // Perform the implicit ToObject for primitives here.
       // Implemented according to ES6 section 7.3.2 GetV (V, P).
@@ -883,6 +882,7 @@ void CompilationDependencies::DependOnStablePrototypeChains(
       CHECK(constructor.has_value());
       receiver_map = constructor->initial_map(this);
     }
+    if (start == kStartAtReceiver) DependOnStableMap(receiver_map);
     DependOnStablePrototypeChain(this, receiver_map, last_prototype);
   }
 }