[compiler] Properly guard the speculative optimizations for instanceof.

src/compiler/ast-graph-builder.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/ast-graph-builder.h"
 
 #include "src/ast/compile-time-value.h"
 #include "src/ast/scopes.h"
 #include "src/compilation-info.h"
 #include "src/compiler.h"
@@ skipping 2808 matching lines @@
       break;
     case Token::GT:
       op = javascript()->GreaterThan(hint);
       break;
     case Token::LTE:
       op = javascript()->LessThanOrEqual(hint);
       break;
     case Token::GTE:
       op = javascript()->GreaterThanOrEqual(hint);
       break;
-    case Token::INSTANCEOF:
-      op = javascript()->InstanceOf();
+    case Token::INSTANCEOF: {
+      VectorSlotPair feedback =
+          CreateVectorSlotPair(expr->CompareOperationFeedbackSlot());
+      op = javascript()->InstanceOf(feedback);
       break;
+    }
     case Token::IN:
       op = javascript()->HasProperty();
       break;
     default:
       op = nullptr;
       UNREACHABLE();
   }
   VisitForValue(expr->left());
   VisitForValue(expr->right());
   Node* right = environment()->Pop();
@@ skipping 1482 matching lines @@
     // Phi does not exist yet, introduce one.
     value = NewPhi(inputs, value, control);
     value->ReplaceInput(inputs - 1, other);
   }
   return value;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8