[maps] Avoid self-prototype transition in Map::GetDerivedMap

When Map::GetDerivedMap is called with a non-JSObject prototype (such
as a JSProxy) that matches from->prototype(), it previously called
TransitionRootMapToPrototypeForNewObject unconditionally, creating a
prototype transition to a new map with the same prototype and
back-pointer set to the original root map.

Subsequent MapUpdater runs walked the back-pointer to the original root
map and skipped the prototype transition because root_map_->prototype()
equals *new_prototype_, causing a CHECK_EQ failure in
LookupIterator::IsCacheableTransition().

Fixed: 565836459

TAG=agy
CONV=9d3c2c3d-d780-4e2c-b8ce-ad0e25cd2825

Change-Id: Icdc5ddcdcaf7bd24956bc75f7dabeca1e7fa7b4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8468367
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#110107}