Don't assume that the prototype of an object is always a JSObject when
inlining the known receiver map case for abstract relational comparison.

BUG=chromium:679202
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2621583002
Cr-Commit-Position: refs/heads/master@{#42123}