X87: [crankshaft] Deoptimize if HHasInPrototypeChainAndBranch hits a proxy.

src/crankshaft/x87/lithium-codegen-x87.cc

Index: src/crankshaft/x87/lithium-codegen-x87.cc
diff --git a/src/crankshaft/x87/lithium-codegen-x87.cc b/src/crankshaft/x87/lithium-codegen-x87.cc
index 0167de94b39843bdf91df922bb06be02dac4afc1..bd9b6b403733f3af749e8e4df10df0f8a193e939 100644
--- a/src/crankshaft/x87/lithium-codegen-x87.cc
+++ b/src/crankshaft/x87/lithium-codegen-x87.cc
@@ -2880,6 +2880,8 @@ void LCodeGen::DoHasInPrototypeChainAndBranch(
   __ mov(object_map, FieldOperand(object, HeapObject::kMapOffset));
   Label loop;
   __ bind(&loop);
+  __ CmpInstanceType(object_map, JS_PROXY_TYPE);
+  DeoptimizeIf(equal, instr, Deoptimizer::kProxy);
   __ mov(object_prototype, FieldOperand(object_map, Map::kPrototypeOffset));
   __ cmp(object_prototype, prototype);
   EmitTrueBranch(instr, equal);