[compiler] Properly guard the speculative optimizations for instanceof.

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 #include "src/ic/handler-configuration.h"
 #include "src/ic/stub-cache.h"
@@ skipping 3868 matching lines @@
 
       var_holder.Bind(proto);
       var_holder_map.Bind(map);
       var_holder_instance_type.Bind(instance_type);
       Goto(&loop);
     }
   }
 }
 
 Node* CodeStubAssembler::OrdinaryHasInstance(Node* context, Node* callable,
-                                             Node* object) {
+                                             Node* object,
+                                             VectorSlotPair feedback) {
   Variable var_result(this, MachineRepresentation::kTagged);
   Label return_false(this), return_true(this),
       return_runtime(this, Label::kDeferred), return_result(this);
 
   // Goto runtime if {object} is a Smi.
   GotoIf(WordIsSmi(object), &return_runtime);
 
   // Load map of {object}.
   Node* object_map = LoadMap(object);
 
@@ skipping 104 matching lines @@
 
   Bind(&return_false);
   StoreRoot(Heap::kInstanceofCacheAnswerRootIndex, BooleanConstant(false));
   var_result.Bind(BooleanConstant(false));
   Goto(&return_result);
 
   Bind(&return_runtime);
   {
     // Invalidate the global instanceof cache.
     StoreRoot(Heap::kInstanceofCacheFunctionRootIndex, SmiConstant(0));
+
+    // Record megamorphic {feedback} if requested; we use this feedback to
+    // guard a bunch of speculative optimizations in TurboFand (and Crankshaft)
+    // that just deoptimize in case of funny inputs to instanceof.
+    if (feedback.IsValid()) {
+      Node* megamorphic_sentinel =
+          HeapConstant(TypeFeedbackVector::MegamorphicSentinel(isolate()));
+      StoreFixedArrayElement(feedback.vector(), feedback.index(),
+                             megamorphic_sentinel, SKIP_WRITE_BARRIER);
+    }
+
     // Fallback to the runtime implementation.
     var_result.Bind(
         CallRuntime(Runtime::kOrdinaryHasInstance, context, callable, object));
   }
   Goto(&return_result);
 
   Bind(&return_result);
   return var_result.value();
 }
 
@@ skipping 1615 matching lines @@
                        Heap::kTheHoleValueRootIndex);
 
   // Store the WeakCell in the feedback vector.
   StoreFixedArrayElement(feedback_vector, slot, cell, UPDATE_WRITE_BARRIER,
                          CodeStubAssembler::SMI_PARAMETERS);
   return cell;
 }
 
 }  // namespace internal
 }  // namespace v8