For HashTable-backed JS objects, use the proper type in the table() accessor

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 12413123c09c2a922da3f76a7fbe3679a3dd0609..8e729dfac32fcb8bfc4610284c1e79581262572e 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -8150,7 +8150,7 @@ class JSFunctionProxy: public JSProxy {
 class JSSet: public JSObject {
  public:
   // [set]: the backing hash set containing keys.
-  DECL_ACCESSORS(table, Object)
+  DECL_ACCESSORS(table, ObjectHashSet)
 
   // Casting.
   static inline JSSet* cast(Object* obj);
@@ -8171,7 +8171,7 @@ class JSSet: public JSObject {
 class JSMap: public JSObject {
  public:
   // [table]: the backing hash table mapping keys to values.
-  DECL_ACCESSORS(table, Object)
+  DECL_ACCESSORS(table, ObjectHashTable)
 
   // Casting.
   static inline JSMap* cast(Object* obj);
@@ -8192,7 +8192,7 @@ class JSMap: public JSObject {
 class JSWeakMap: public JSObject {
  public:
   // [table]: the backing hash table mapping keys to values.
-  DECL_ACCESSORS(table, Object)
+  DECL_ACCESSORS(table, ObjectHashTable)
 
   // [next]: linked list of encountered weak maps during GC.
   DECL_ACCESSORS(next, Object)