[maps] Add check for is_prototype_map being set correctly

Bug: v8:11525
Change-Id: I59fdb446d2b704ef386a8695ee3ddd1b1cdd1dac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3635724Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80464}

src/objects/map-inl.h

@@ -52,7 +52,8 @@ RELEASE_ACQUIRE_WEAK_ACCESSORS(Map, raw_transitions,
                                kTransitionsOrPrototypeInfoOffset)
 
 ACCESSORS_CHECKED2(Map, prototype, HeapObject, kPrototypeOffset, true,
-                   value.IsNull() || value.IsJSReceiver())
+                   value.IsNull() || value.IsJSProxy() ||
+                       (value.IsJSObject() && value.map().is_prototype_map()))
 
 DEF_GETTER(Map, prototype_info, Object) {
   Object value = TaggedField<Object, kTransitionsOrPrototypeInfoOffset>::load(