[compiler] Properly guard the speculative optimizations for instanceof.

src/code-stub-assembler.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_CODE_STUB_ASSEMBLER_H_
 #define V8_CODE_STUB_ASSEMBLER_H_
 
 #include <functional>
 
 #include "src/compiler/code-assembler.h"
 #include "src/objects.h"
 
 namespace v8 {
 namespace internal {
 
 class CallInterfaceDescriptor;
 class StatsCounter;
 class StubCache;
 
 enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
 
 // Provides JavaScript-specific "macro-assembler" functionality on top of the
 // CodeAssembler. By factoring the JavaScript-isms out of the CodeAssembler,
 // it's possible to add JavaScript-specific useful CodeAssembler "macros"
 // without modifying files in the compiler directory (and requiring a review
 // from a compiler directory OWNER).
 class CodeStubAssembler : public compiler::CodeAssembler {
  public:
+  class VectorSlotPair final {
+   public:
+    VectorSlotPair() : vector_(nullptr), index_(nullptr) {}
+    VectorSlotPair(compiler::Node* vector, compiler::Node* index)
+        : vector_(vector), index_(index) {
+      DCHECK_NOT_NULL(vector);
+      DCHECK_NOT_NULL(index);
+    }
+
+    bool IsValid() const { return vector_ != nullptr; }
+    compiler::Node* vector() const { return vector_; }
+    compiler::Node* index() const { return index_; }
+
+   private:
+    compiler::Node* const vector_;
+    compiler::Node* const index_;
+  };
+
   // Create with CallStub linkage.
   // |result_size| specifies the number of results returned by the stub.
   // TODO(rmcilroy): move result_size to the CallInterfaceDescriptor.
   CodeStubAssembler(Isolate* isolate, Zone* zone,
                     const CallInterfaceDescriptor& descriptor,
                     Code::Flags flags, const char* name,
                     size_t result_size = 1);
 
   // Create with JSCall linkage.
   CodeStubAssembler(Isolate* isolate, Zone* zone, int parameter_count,
@@ skipping 581 matching lines @@
   // Upon reaching the end of prototype chain the control goes to {if_end}.
   // If it can't handle the case {receiver}/{key} case then the control goes
   // to {if_bailout}.
   void TryPrototypeChainLookup(compiler::Node* receiver, compiler::Node* key,
                                LookupInHolder& lookup_property_in_holder,
                                LookupInHolder& lookup_element_in_holder,
                                Label* if_end, Label* if_bailout);
 
   // Instanceof helpers.
   // ES6 section 7.3.19 OrdinaryHasInstance (C, O)
-  compiler::Node* OrdinaryHasInstance(compiler::Node* context,
-                                      compiler::Node* callable,
-                                      compiler::Node* object);
+  compiler::Node* OrdinaryHasInstance(
+      compiler::Node* context, compiler::Node* callable, compiler::Node* object,
+      VectorSlotPair feedback = VectorSlotPair());
 
   // LoadIC helpers.
   struct LoadICParameters {
     LoadICParameters(compiler::Node* context, compiler::Node* receiver,
                      compiler::Node* name, compiler::Node* slot,
                      compiler::Node* vector)
         : context(context),
           receiver(receiver),
           name(name),
           slot(slot),
@@ skipping 200 matching lines @@
                                            Label* bailout);
 
   static const int kElementLoopUnrollThreshold = 8;
 };
 
 DEFINE_OPERATORS_FOR_FLAGS(CodeStubAssembler::AllocationFlags);
 
 }  // namespace internal
 }  // namespace v8
 #endif  // V8_CODE_STUB_ASSEMBLER_H_