| Index: src/ia32/full-codegen-ia32.cc
 | 
| diff --git a/src/ia32/full-codegen-ia32.cc b/src/ia32/full-codegen-ia32.cc
 | 
| index d20e6223e1195ecad3ee5a61c26705437e527086..2b629724a5ba7704c79dd189b6695fb1fee9a2f3 100644
 | 
| --- a/src/ia32/full-codegen-ia32.cc
 | 
| +++ b/src/ia32/full-codegen-ia32.cc
 | 
| @@ -861,7 +861,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
 | 
|    Label convert, done_convert;
 | 
|    __ test(eax, Immediate(kSmiTagMask));
 | 
|    __ j(zero, &convert, Label::kNear);
 | 
| -  __ CmpObjectType(eax, FIRST_JS_OBJECT_TYPE, ecx);
 | 
| +  __ CmpObjectType(eax, FIRST_OBJECT_OR_FUNCTION_CLASS_TYPE, ecx);
 | 
|    __ j(above_equal, &done_convert, Label::kNear);
 | 
|    __ bind(&convert);
 | 
|    __ push(eax);
 | 
| @@ -2385,9 +2385,9 @@ void FullCodeGenerator::EmitIsObject(ZoneList<Expression*>* args) {
 | 
|    __ test(ecx, Immediate(1 << Map::kIsUndetectable));
 | 
|    __ j(not_zero, if_false);
 | 
|    __ movzx_b(ecx, FieldOperand(ebx, Map::kInstanceTypeOffset));
 | 
| -  __ cmp(ecx, FIRST_JS_OBJECT_TYPE);
 | 
| +  __ cmp(ecx, FIRST_OBJECT_CLASS_TYPE);
 | 
|    __ j(below, if_false);
 | 
| -  __ cmp(ecx, LAST_JS_OBJECT_TYPE);
 | 
| +  __ cmp(ecx, LAST_OBJECT_CLASS_TYPE);
 | 
|    PrepareForBailoutBeforeSplit(TOS_REG, true, if_true, if_false);
 | 
|    Split(below_equal, if_true, if_false, fall_through);
 | 
|  
 | 
| @@ -2409,7 +2409,7 @@ void FullCodeGenerator::EmitIsSpecObject(ZoneList<Expression*>* args) {
 | 
|  
 | 
|    __ test(eax, Immediate(kSmiTagMask));
 | 
|    __ j(equal, if_false);
 | 
| -  __ CmpObjectType(eax, FIRST_JS_OBJECT_TYPE, ebx);
 | 
| +  __ CmpObjectType(eax, FIRST_OBJECT_OR_FUNCTION_CLASS_TYPE, ebx);
 | 
|    PrepareForBailoutBeforeSplit(TOS_REG, true, if_true, if_false);
 | 
|    Split(above_equal, if_true, if_false, fall_through);
 | 
|  
 | 
| @@ -2695,16 +2695,17 @@ void FullCodeGenerator::EmitClassOf(ZoneList<Expression*>* args) {
 | 
|  
 | 
|    // Check that the object is a JS object but take special care of JS
 | 
|    // functions to make sure they have 'Function' as their class.
 | 
| -  __ CmpObjectType(eax, FIRST_JS_OBJECT_TYPE, eax);  // Map is now in eax.
 | 
| +  __ CmpObjectType(eax, FIRST_OBJECT_OR_FUNCTION_CLASS_TYPE, eax);
 | 
| +  // Map is now in eax.
 | 
|    __ j(below, &null);
 | 
|  
 | 
| -  // As long as JS_FUNCTION_TYPE is the last instance type and it is
 | 
| -  // right after LAST_JS_OBJECT_TYPE, we can avoid checking for
 | 
| -  // LAST_JS_OBJECT_TYPE.
 | 
| -  ASSERT(LAST_TYPE == JS_FUNCTION_TYPE);
 | 
| -  ASSERT(JS_FUNCTION_TYPE == LAST_JS_OBJECT_TYPE + 1);
 | 
| -  __ CmpInstanceType(eax, JS_FUNCTION_TYPE);
 | 
| -  __ j(equal, &function);
 | 
| +  // As long as LAST_FUNCTION_CLASS_TYPE is the last instance type, and
 | 
| +  // FIRST_FUNCTION_CLASS_TYPE comes right after LAST_OBJECT_CLASS_TYPE,
 | 
| +  // we can avoid checking for LAST_OBJECT_CLASS_TYPE.
 | 
| +  ASSERT(LAST_TYPE == LAST_FUNCTION_CLASS_TYPE);
 | 
| +  ASSERT(FIRST_FUNCTION_CLASS_TYPE == LAST_OBJECT_CLASS_TYPE + 1);
 | 
| +  __ CmpInstanceType(eax, FIRST_FUNCTION_CLASS_TYPE);
 | 
| +  __ j(above_equal, &function);
 | 
|  
 | 
|    // Check if the constructor in the map is a function.
 | 
|    __ mov(eax, FieldOperand(eax, Map::kConstructorOffset));
 | 
| @@ -4049,10 +4050,10 @@ bool FullCodeGenerator::TryLiteralCompare(Token::Value op,
 | 
|      __ JumpIfSmi(eax, if_false);
 | 
|      __ cmp(eax, isolate()->factory()->null_value());
 | 
|      __ j(equal, if_true);
 | 
| -    __ CmpObjectType(eax, FIRST_JS_OBJECT_TYPE, edx);
 | 
| +    __ CmpObjectType(eax, FIRST_OBJECT_CLASS_TYPE, edx);
 | 
|      __ j(below, if_false);
 | 
| -    __ CmpInstanceType(edx, FIRST_FUNCTION_CLASS_TYPE);
 | 
| -    __ j(above_equal, if_false);
 | 
| +    __ CmpInstanceType(edx, LAST_OBJECT_CLASS_TYPE);
 | 
| +    __ j(above, if_false);
 | 
|      // Check for undetectable objects => false.
 | 
|      __ test_b(FieldOperand(edx, Map::kBitFieldOffset),
 | 
|                1 << Map::kIsUndetectable);
 | 
| 
 |