S390: InstanceOfStub incorrectly interprets the hole as a prototype.

src/s390/code-stubs-s390.cc

Index: src/s390/code-stubs-s390.cc
diff --git a/src/s390/code-stubs-s390.cc b/src/s390/code-stubs-s390.cc
index 0027dbdf64541534b909cd812284e82c6ade8fc9..95eaec12443cb239c9da224c51561608cee8c4ee 100644
--- a/src/s390/code-stubs-s390.cc
+++ b/src/s390/code-stubs-s390.cc
@@ -1414,8 +1414,12 @@ void InstanceOfStub::Generate(MacroAssembler* masm) {
   __ CompareObjectType(function, function_map, scratch, JS_FUNCTION_TYPE);
   __ bne(&slow_case);
 
-  // Ensure that {function} has an instance prototype.
+  // Go to the runtime if the function is not a constructor.
   __ LoadlB(scratch, FieldMemOperand(function_map, Map::kBitFieldOffset));
+  __ TestBit(scratch, Map::kIsConstructor, r0);
+  __ beq(&slow_case);
+
+  // Ensure that {function} has an instance prototype.
   __ TestBit(scratch, Map::kHasNonInstancePrototype, r0);
   __ bne(&slow_case);