Map::HasOnlyStablePrototypesWithFastElements and
Map::SerializeForElementStore were asking if the prototype was a
JSObject but they were doing so with the original map on every loop
iteration instead of the current prototype's map.

Also, we can change it so that instead of using the underlying data
to check if it was a JSObject, but we can get the same information
reading the map's instance_type directly.

Bug: v8:7790
Change-Id: I314b361e59dd16e101d4fbcfbe558aeffd576cd5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2859164
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74294}