[WIP] Try InstanceOf for Box2d.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-typed-lowering.h"
 
 #include "src/builtins/builtins-utils.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 1258 matching lines @@
         return Changed(node);
       }
     }
   }
   return NoChange();
 }
 
 Reduction JSTypedLowering::ReduceJSInstanceOf(Node* node) {
   DCHECK_EQ(IrOpcode::kJSInstanceOf, node->opcode());
   VectorSlotPair const& feedback = VectorSlotPairOf(node->op());
+  Node* right = NodeProperties::GetValueInput(node, 1);
+  Type* right_type = NodeProperties::GetType(right);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
 
   // If deoptimization is disabled, we cannot optimize.
   if (!(flags() & kDeoptimizationEnabled)) return NoChange();
 
   // Make sure we do have feedback for the {node}, and check that the
   // {feedback} suggests that we haven't seen any funny inputs in this
   // place so far.
   // TODO(turbofan): We might want to collect the right-hand side map
   // for instanceof and turn this into some vector based InstanceOfIC.
   if (!feedback.IsValid()) return NoChange();
   if (feedback.vector()->Get(feedback.slot()) !=
       *TypeFeedbackVector::UninitializedSentinel(isolate())) {
     return NoChange();
   }
 
-  JSBinopReduction r(this, node);
-  if (!r.right_type()->IsConstant() ||
-      !r.right_type()->AsConstant()->Value()->IsJSFunction()) {
-    return NoChange();
-  }
-
-  Handle<JSFunction> function =
-      Handle<JSFunction>::cast(r.right_type()->AsConstant()->Value());
-  Handle<SharedFunctionInfo> shared(function->shared(), isolate());
-
-  // Make sure the prototype of {function} is the %FunctionPrototype%, and it
-  // already has a meaningful initial map (i.e. we constructed at least one
-  // instance using the constructor {function}).
-  if (function->map()->prototype() != function->native_context()->closure() ||
-      function->map()->has_non_instance_prototype() ||
-      !function->has_initial_map()) {
-    return NoChange();
-  }
-
   // We can only use the fast case if @@hasInstance was not used so far.
   if (!isolate()->IsHasInstanceLookupChainIntact()) return NoChange();
+
+  if (right_type->IsConstant() &&
+      right_type->AsConstant()->Value()->IsJSFunction()) {
+    Handle<JSFunction> function =
+        Handle<JSFunction>::cast(right_type->AsConstant()->Value());
+    Handle<SharedFunctionInfo> shared(function->shared(), isolate());
+
+    // Make sure the prototype of {function} is the %FunctionPrototype%, and it
+    // already has a meaningful initial map (i.e. we constructed at least one
+    // instance using the constructor {function}).
+    if (function->map()->prototype() != function->native_context()->closure() ||
+        function->map()->has_non_instance_prototype() ||
+        !function->has_initial_map()) {
+      return NoChange();
+    }
+
+    Handle<Map> initial_map(function->initial_map(), isolate());
+    dependencies()->AssumeInitialMapCantChange(initial_map);
+    Handle<Object> prototype(initial_map->prototype(), isolate());
+    right = jsgraph()->Constant(prototype);
+  } else {
+    // The {right} hand side must be a HeapObject.
+    effect = graph()->NewNode(simplified()->CheckHeapObject(), right, effect,
+                              control);
+
+    // TODO(bmeurer): Properly check the right-hand side with above conditions.
+    right = effect = graph()->NewNode(
+        simplified()->LoadField(
+            AccessBuilder::ForJSFunctionPrototypeOrInitialMap()),
+        right, effect, control);
+    right = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForMapPrototype()),
+        right, effect, control);
+  }
+
+  // Add the code dependency to protect against @@hasInstance.
   dependencies()->AssumePropertyCell(factory()->has_instance_protector());
 
-  Handle<Map> initial_map(function->initial_map(), isolate());
-  dependencies()->AssumeInitialMapCantChange(initial_map);
-  Node* prototype =
-      jsgraph()->Constant(handle(initial_map->prototype(), isolate()));
-
-  // Morph the {node} into an optimistic prototype chain walk (which  just
+  // Morph the {node} into an optimistic prototype chain walk (which just
   // deopts if it sees anything funny in the prototype chain, i.e. a proxy).
   RelaxControls(node);
-  node->ReplaceInput(1, prototype);  // prototype
-  node->RemoveInput(3);              // frame state
-  node->RemoveInput(2);              // context
+  NodeProperties::ReplaceValueInput(node, right, 1);  // prototype
+  NodeProperties::ReplaceEffectInput(node, effect);   // effect
+  node->RemoveInput(3);                               // frame state
+  node->RemoveInput(2);                               // context
   NodeProperties::ChangeOp(node, simplified()->CheckHasInPrototypeChain());
   return Changed(node);
 }
 
 Reduction JSTypedLowering::ReduceJSLoadContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
   ContextAccess const& access = ContextAccessOf(node->op());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = graph()->start();
   for (size_t i = 0; i < access.depth(); ++i) {
@@ skipping 708 matching lines @@
 }
 
 
 CompilationDependencies* JSTypedLowering::dependencies() const {
   return dependencies_;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8