[builtins] fix mapcheck in Array.includes fast-case when searching for String

src/builtins/builtins-array.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
 #include "src/elements.h"
 
@@ skipping 1499 matching lines @@
     assembler->Bind(&string_loop);
     {
       Label continue_loop(assembler);
       assembler->GotoUnless(
           assembler->Int32LessThan(index_var.value(), len_var.value()),
           &return_false);
       Node* element_k =
           assembler->LoadFixedArrayElement(elements, index_var.value());
       assembler->GotoIf(assembler->WordIsSmi(element_k), &continue_loop);
       assembler->GotoUnless(assembler->Int32LessThan(
-                                assembler->LoadMapInstanceType(element_k),
+                                assembler->LoadInstanceType(element_k),
                                 assembler->Int32Constant(FIRST_NONSTRING_TYPE)),
                             &continue_loop);
 
       // TODO(bmeurer): Consider inlining the StringEqual logic here.
       Callable callable = CodeFactory::StringEqual(assembler->isolate());
       Node* result =
           assembler->CallStub(callable, context, search_element, element_k);
       assembler->Branch(
           assembler->WordEqual(assembler->BooleanConstant(true), result),
           &return_true, &continue_loop);
@@ skipping 203 matching lines @@
   assembler->Return(assembler->BooleanConstant(false));
 
   assembler->Bind(&call_runtime);
   assembler->Return(assembler->CallRuntime(Runtime::kArrayIncludes_Slow,
                                            context, array, search_element,
                                            start_from));
 }
 
 }  // namespace internal
 }  // namespace v8