[compiler] Properly guard the speculative optimizations for instanceof.

src/compiler/js-operator.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-operator.h"
 
 #include <limits>
 
 #include "src/base/lazy-instance.h"
 #include "src/compiler/opcodes.h"
@@ skipping 21 matching lines @@
 
 bool operator!=(VectorSlotPair const& lhs, VectorSlotPair const& rhs) {
   return !(lhs == rhs);
 }
 
 
 size_t hash_value(VectorSlotPair const& p) {
   return base::hash_combine(p.slot(), p.vector().location());
 }
 
+std::ostream& operator<<(std::ostream& os, VectorSlotPair const& p) {
+  if (p.IsValid()) {
+    os << p.index();
+  } else {
+    os << "N/A";
+  }
+  return os;
+}
 
 ConvertReceiverMode ConvertReceiverModeOf(Operator const* op) {
   DCHECK_EQ(IrOpcode::kJSConvertReceiver, op->opcode());
   return OpParameter<ConvertReceiverMode>(op);
 }
 
 
 ToBooleanHints ToBooleanHintsOf(Operator const* op) {
   DCHECK_EQ(IrOpcode::kJSToBoolean, op->opcode());
   return OpParameter<ToBooleanHints>(op);
@@ skipping 377 matching lines @@
          op->opcode() == IrOpcode::kJSNotEqual ||
          op->opcode() == IrOpcode::kJSStrictEqual ||
          op->opcode() == IrOpcode::kJSStrictNotEqual ||
          op->opcode() == IrOpcode::kJSLessThan ||
          op->opcode() == IrOpcode::kJSGreaterThan ||
          op->opcode() == IrOpcode::kJSLessThanOrEqual ||
          op->opcode() == IrOpcode::kJSGreaterThanOrEqual);
   return OpParameter<CompareOperationHint>(op);
 }
 
+VectorSlotPair const& VectorSlotPairOf(const Operator* op) {
+  DCHECK_EQ(IrOpcode::kJSInstanceOf, op->opcode());
+  return OpParameter<VectorSlotPair>(op);
+}
+
 #define CACHED_OP_LIST(V)                                   \
   V(ToInteger, Operator::kNoProperties, 1, 1)               \
   V(ToLength, Operator::kNoProperties, 1, 1)                \
   V(ToName, Operator::kNoProperties, 1, 1)                  \
   V(ToNumber, Operator::kNoProperties, 1, 1)                \
   V(ToObject, Operator::kFoldable, 1, 1)                    \
   V(ToString, Operator::kNoProperties, 1, 1)                \
   V(Create, Operator::kEliminatable, 2, 1)                  \
   V(CreateIterResultObject, Operator::kEliminatable, 2, 1)  \
   V(HasProperty, Operator::kNoProperties, 2, 1)             \
   V(TypeOf, Operator::kPure, 1, 1)                          \
-  V(InstanceOf, Operator::kNoProperties, 2, 1)              \
   V(ForInNext, Operator::kNoProperties, 4, 1)               \
   V(ForInPrepare, Operator::kNoProperties, 1, 3)            \
   V(LoadMessage, Operator::kNoThrow, 0, 1)                  \
   V(StoreMessage, Operator::kNoThrow, 1, 0)                 \
   V(GeneratorRestoreContinuation, Operator::kNoThrow, 1, 1) \
   V(StackCheck, Operator::kNoWrite, 0, 0)
 
 #define BINARY_OP_LIST(V) \
   V(BitwiseOr)            \
   V(BitwiseXor)           \
@@ skipping 297 matching lines @@
 const Operator* JSOperatorBuilder::StoreContext(size_t depth, size_t index) {
   ContextAccess access(depth, index, false);
   return new (zone()) Operator1<ContextAccess>(  // --
       IrOpcode::kJSStoreContext,                 // opcode
       Operator::kNoRead | Operator::kNoThrow,    // flags
       "JSStoreContext",                          // name
       2, 1, 1, 0, 1, 0,                          // counts
       access);                                   // parameter
 }
 
+const Operator* JSOperatorBuilder::InstanceOf(VectorSlotPair const& feedback) {
+  return new (zone()) Operator1<VectorSlotPair>(         // --
+      IrOpcode::kJSInstanceOf, Operator::kNoProperties,  // opcode
+      "JSInstanceOf",                                    // name
+      2, 1, 1, 1, 1, 2,                                  // counts
+      feedback);                                         // parameter
+}
 
 const Operator* JSOperatorBuilder::CreateArguments(CreateArgumentsType type) {
   return new (zone()) Operator1<CreateArgumentsType>(         // --
       IrOpcode::kJSCreateArguments, Operator::kEliminatable,  // opcode
       "JSCreateArguments",                                    // name
       1, 1, 0, 1, 1, 0,                                       // counts
       type);                                                  // parameter
 }
 
 
@@ skipping 99 matching lines @@
   return new (zone()) Operator1<Handle<ScopeInfo>>(               // --
       IrOpcode::kJSCreateScriptContext, Operator::kNoProperties,  // opcode
       "JSCreateScriptContext",                                    // name
       1, 1, 1, 1, 1, 2,                                           // counts
       scpope_info);                                               // parameter
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8