[turbofan] Add support for %_IsSpecObject intrinsic lowering.

test/unittests/compiler/js-intrinsic-lowering-unittest.cc

Index: test/unittests/compiler/js-intrinsic-lowering-unittest.cc
diff --git a/test/unittests/compiler/js-intrinsic-lowering-unittest.cc b/test/unittests/compiler/js-intrinsic-lowering-unittest.cc
index a22f660c21cb20780a234ed61cb8ec7110075c8e..c3f3b22d567fae1f667c08c3dc4098fc1aadf899 100644
--- a/test/unittests/compiler/js-intrinsic-lowering-unittest.cc
+++ b/test/unittests/compiler/js-intrinsic-lowering-unittest.cc
@@ -284,6 +284,38 @@ TEST_F(JSIntrinsicLoweringTest, InlineIsRegExp) {
 
 
 // -----------------------------------------------------------------------------
+// %_IsSpecObject
+
+
+TEST_F(JSIntrinsicLoweringTest, InlineIsSpecObject) {
+  Node* const input = Parameter(0);
+  Node* const context = Parameter(1);
+  Node* const effect = graph()->start();
+  Node* const control = graph()->start();
+  Reduction const r = Reduce(graph()->NewNode(
+      javascript()->CallRuntime(Runtime::kInlineIsSpecObject, 1), input,
+      context, effect, control));
+  ASSERT_TRUE(r.Changed());
+
+  Node* phi = r.replacement();
+  Capture<Node *> branch, if_false;
+  EXPECT_THAT(
+      phi,
+      IsPhi(
+          static_cast<MachineType>(kTypeBool | kRepTagged), IsFalseConstant(),
+          IsUint32LessThanOrEqual(
+              IsInt32Constant(FIRST_JS_RECEIVER_TYPE),
+              IsLoadField(AccessBuilder::ForMapInstanceType(),
+                          IsLoadField(AccessBuilder::ForMap(), input, effect,
+                                      CaptureEq(&if_false)),
+                          effect, _)),
+          IsMerge(IsIfTrue(AllOf(CaptureEq(&branch),
+                                 IsBranch(IsObjectIsSmi(input), control))),
+                  AllOf(CaptureEq(&if_false), IsIfFalse(CaptureEq(&branch))))));
+}
+
+
+// -----------------------------------------------------------------------------
 // %_JSValueGetValue