[es6] Fix prototype chain walk for instanceof.

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 #include "src/ic/stub-cache.h"
 
@@ skipping 1938 matching lines @@
                     Int32Constant(0)),
         &return_runtime);
 
     // Check if the current {object} is a proxy.
     Node* object_instance_type = LoadMapInstanceType(object_map);
     GotoIf(Word32Equal(object_instance_type, Int32Constant(JS_PROXY_TYPE)),
            &return_runtime);
 
     // Check the current {object} prototype.
     Node* object_prototype = LoadMapPrototype(object_map);
+    GotoIf(WordEqual(object_prototype, NullConstant()), &return_false);
     GotoIf(WordEqual(object_prototype, callable_prototype), &return_true);
-    GotoIf(WordEqual(object_prototype, NullConstant()), &return_false);
 
     // Continue with the prototype.
     var_object_map.Bind(LoadMap(object_prototype));
     Goto(&loop);
   }
 
   Bind(&return_true);
   StoreRoot(Heap::kInstanceofCacheAnswerRootIndex, BooleanConstant(true));
   var_result.Bind(BooleanConstant(true));
   Goto(&return_result);
@@ skipping 330 matching lines @@
     Code::Flags code_flags =
         Code::RemoveHolderFromFlags(Code::ComputeHandlerFlags(Code::LOAD_IC));
 
     TryProbeStubCache(isolate()->stub_cache(), code_flags, p->receiver, p->name,
                       &if_handler, &var_handler, if_miss);
   }
 }
 
 }  // namespace internal
 }  // namespace v8