Correctify instanceof and make it optimizable.

test/mjsunit/regress/regress-4376-2.js

Index: test/mjsunit/regress/regress-4376-2.js
diff --git a/test/message/arrow-bare-rest-param.js b/test/mjsunit/regress/regress-4376-2.js
similarity index 56%
copy from test/message/arrow-bare-rest-param.js
copy to test/mjsunit/regress/regress-4376-2.js
index 9b3916d95952e7eb3f5cd61d02f634a994071c43..2a37204eabed593f9a82f150843fac77a4043dac 100644
--- a/test/message/arrow-bare-rest-param.js
+++ b/test/mjsunit/regress/regress-4376-2.js
@@ -1,7 +1,9 @@
 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --harmony-rest-parameters --harmony-arrow-functions
 
-...x => 10
+function Foo() {}
+var x = new Foo();
+Foo.prototype = 1;
+function foo() { return x instanceof Foo; }
+assertThrows(foo, TypeError);