[compiler] Update prototype chain lookup on MapRef and MapData

Map::HasOnlyStablePrototypesWithFastElements and
Map::SerializeForElementStore were asking if the prototype was a
JSObject but they were doing so with the original map on every loop
iteration instead of the current prototype's map.

Also, we can change it so that instead of using the underlying data
to check if it was a JSObject, but we can get the same information
reading the map's instance_type directly.

Bug: v8:7790
Change-Id: I314b361e59dd16e101d4fbcfbe558aeffd576cd5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2859164
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74294}

src/compiler/heap-refs.cc

@@ -2946,15 +2946,11 @@ void MapData::SerializeForElementStore(JSHeapBroker* broker) {
   // constructing MapRefs, but it involves non-trivial refactoring and this
   // method should go away anyway once the compiler is fully concurrent.
   MapRef map(broker, this);
-  for (MapRef prototype_map = map;;) {
-    prototype_map.SerializePrototype();
-    prototype_map = prototype_map.prototype().map();
-    if (prototype_map.oddball_type() == OddballType::kNull ||
-        !map.prototype().IsJSObject() || !prototype_map.is_stable() ||
-        !IsFastElementsKind(prototype_map.elements_kind())) {
-      return;
-    }
-  }
+  do {
+    map.SerializePrototype();
+    map = map.prototype().map();
+  } while (map.IsJSObjectMap() && map.is_stable() &&
+           IsFastElementsKind(map.elements_kind()));
 }
 
 bool MapRef::HasOnlyStablePrototypesWithFastElements(
@@ -2962,7 +2958,7 @@ bool MapRef::HasOnlyStablePrototypesWithFastElements(
   DCHECK_NOT_NULL(prototype_maps);
   MapRef prototype_map = prototype().map();
   while (prototype_map.oddball_type() != OddballType::kNull) {
-    if (!prototype().IsJSObject() || !prototype_map.is_stable() ||
+    if (!prototype_map.IsJSObjectMap() || !prototype_map.is_stable() ||
         !IsFastElementsKind(prototype_map.elements_kind())) {
       return false;
     }