[crankshaft] Deoptimize if HHasInPrototypeChainAndBranch hits a proxy.

src/crankshaft/ia32/lithium-codegen-ia32.cc

Index: src/crankshaft/ia32/lithium-codegen-ia32.cc
diff --git a/src/crankshaft/ia32/lithium-codegen-ia32.cc b/src/crankshaft/ia32/lithium-codegen-ia32.cc
index 50c7e94999e9aa7c69bf91a41e2c7bc4d0bbd4f5..6648f46e2fe4e305312f7dc0618c88face96f31b 100644
--- a/src/crankshaft/ia32/lithium-codegen-ia32.cc
+++ b/src/crankshaft/ia32/lithium-codegen-ia32.cc
@@ -2597,6 +2597,8 @@ void LCodeGen::DoHasInPrototypeChainAndBranch(
   __ mov(object_map, FieldOperand(object, HeapObject::kMapOffset));
   Label loop;
   __ bind(&loop);
+  __ CmpInstanceType(object_map, JS_PROXY_TYPE);
+  DeoptimizeIf(equal, instr, Deoptimizer::kProxy);
   __ mov(object_prototype, FieldOperand(object_map, Map::kPrototypeOffset));
   __ cmp(object_prototype, prototype);
   EmitTrueBranch(instr, equal);