[turbofan] Use correct map for special JSObject accessors.

[turbofan] Use correct map for special JSObject accessors.

This fixes a small inconsistency when the accessor is on a prototype,
because the property access has to respect the holder (and not always go
to the receiver unconditionally).

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/6367c0798ee297a9319de539e0073035785c1185
Cr-Commit-Position: refs/heads/master@{#31375}

[Jarin, 2015-10-19 12:30:53]

lgtm

[Benedikt Meurer, 2015-10-19 12:34:49]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2015-10-19 12:34:50]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1409273005/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1409273005/1

[commit-bot: I haz the power, 2015-10-19 13:25:00]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-10-19 13:25:31]

Patchset 1 (id:??) landed as
https://crrev.com/6367c0798ee297a9319de539e0073035785c1185
Cr-Commit-Position: refs/heads/master@{#31375}