[es6] Reintroduce the instanceof operator in the backends.

test/mjsunit/harmony/instanceof-es6.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-instanceof
 
 // Make sure it's an error if @@hasInstance isn't a function.
 (function() {
   var F = {};
   F[Symbol.hasInstance] = null;
@@ skipping 30 matching lines @@
   assertEquals(bound[Symbol.hasInstance](bc), true);
   assertEquals(bound[Symbol.hasInstance]([]), false);
 })();
 
 // if OrdinaryHasInstance is passed a non-callable receiver, return false.
 assertEquals(Function.prototype[Symbol.hasInstance].call(Array, []), true);
 assertEquals(Function.prototype[Symbol.hasInstance].call({}, {}), false);
 
 // OrdinaryHasInstance passed a non-object argument returns false.
 assertEquals(Function.prototype[Symbol.hasInstance].call(Array, 0), false);
+
+// Cannot assign to @@hasInstance with %FunctionPrototype%.
+(function() {
+  "use strict";
+  function F() {}
+  assertThrows(function() { F[Symbol.hasInstance] = (v) => v }, TypeError);
+})();
+
+// Check correct invocation of @@hasInstance handler on function instance.
+(function() {
+  function F() {}
+  var counter = 0;
+  var proto = Object.getPrototypeOf(F);
+  Object.setPrototypeOf(F, null);
+  F[Symbol.hasInstance] = function(v) { ++counter; return true };
+  Object.setPrototypeOf(F, proto);
+  assertTrue(1 instanceof F);
+  assertEquals(1, counter);
+})();