[compiler] Support Object.create(null) inlining in TF

src/lookup.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/lookup.h"
 
 #include "src/bootstrapper.h"
 #include "src/deoptimizer.h"
 #include "src/elements.h"
 #include "src/field-type.h"
@@ skipping 55 matching lines @@
 
 void LookupIterator::Next() {
   DCHECK_NE(JSPROXY, state_);
   DCHECK_NE(TRANSITION, state_);
   DisallowHeapAllocation no_gc;
   has_property_ = false;
 
   JSReceiver* holder = *holder_;
   Map* map = holder->map();
 
-  if (map->instance_type() <= LAST_SPECIAL_RECEIVER_TYPE) {
+  if (map->IsSpecialReceiverMap()) {
     state_ = IsElement() ? LookupInSpecialHolder<true>(map, holder)
                          : LookupInSpecialHolder<false>(map, holder);
     if (IsFound()) return;
   }
 
   IsElement() ? NextInternal<true>(map, holder)
               : NextInternal<false>(map, holder);
 }
 
 template <bool is_element>
@@ skipping 787 matching lines @@
 
   // We have found a cached property! Modify the iterator accordingly.
   name_ = maybe_name.ToHandleChecked();
   Restart();
   CHECK_EQ(state(), LookupIterator::DATA);
   return true;
 }
 
 }  // namespace internal
 }  // namespace v8