[es6] Fix prototype chain walk for instanceof.

src/crankshaft/arm64/lithium-codegen-arm64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/crankshaft/arm64/lithium-codegen-arm64.h"
 
 #include "src/arm64/frames-arm64.h"
 #include "src/base/bits.h"
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
@@ skipping 2815 matching lines @@
   // Deoptimize if the object needs to be access checked.
   __ Ldrb(object_instance_type,
           FieldMemOperand(object_map, Map::kBitFieldOffset));
   __ Tst(object_instance_type, Operand(1 << Map::kIsAccessCheckNeeded));
   DeoptimizeIf(ne, instr, Deoptimizer::kAccessCheck);
   // Deoptimize for proxies.
   __ CompareInstanceType(object_map, object_instance_type, JS_PROXY_TYPE);
   DeoptimizeIf(eq, instr, Deoptimizer::kProxy);
 
   __ Ldr(object_prototype, FieldMemOperand(object_map, Map::kPrototypeOffset));
+  __ CompareRoot(object_prototype, Heap::kNullValueRootIndex);
+  __ B(eq, instr->FalseLabel(chunk_));
   __ Cmp(object_prototype, prototype);
   __ B(eq, instr->TrueLabel(chunk_));
-  __ CompareRoot(object_prototype, Heap::kNullValueRootIndex);
-  __ B(eq, instr->FalseLabel(chunk_));
   __ Ldr(object_map, FieldMemOperand(object_prototype, HeapObject::kMapOffset));
   __ B(&loop);
 }
 
 
 void LCodeGen::DoInstructionGap(LInstructionGap* instr) {
   DoGap(instr);
 }
 
 
@@ skipping 2901 matching lines @@
   // Index is equal to negated out of object property index plus 1.
   __ Sub(result, result, Operand::UntagSmiAndScale(index, kPointerSizeLog2));
   __ Ldr(result, FieldMemOperand(result,
                                  FixedArray::kHeaderSize - kPointerSize));
   __ Bind(deferred->exit());
   __ Bind(&done);
 }
 
 }  // namespace internal
 }  // namespace v8