[compiler] Properly guard the speculative optimizations for instanceof.

src/compiler/js-operator.h

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_COMPILER_JS_OPERATOR_H_
 #define V8_COMPILER_JS_OPERATOR_H_
 
 #include "src/runtime/runtime.h"
 #include "src/type-hints.h"
 
@@ skipping 24 matching lines @@
  private:
   const Handle<TypeFeedbackVector> vector_;
   const FeedbackVectorSlot slot_;
 };
 
 bool operator==(VectorSlotPair const&, VectorSlotPair const&);
 bool operator!=(VectorSlotPair const&, VectorSlotPair const&);
 
 size_t hash_value(VectorSlotPair const&);
 
+std::ostream& operator<<(std::ostream&, VectorSlotPair const&);
 
 // The ConvertReceiverMode is used as parameter by JSConvertReceiver operators.
 ConvertReceiverMode ConvertReceiverModeOf(Operator const* op);
 
 
 // The ToBooleanHints are used as parameter by JSToBoolean operators.
 ToBooleanHints ToBooleanHintsOf(Operator const* op);
 
 
 // Defines the arity and the feedback for a JavaScript constructor call. This is
@@ skipping 351 matching lines @@
 size_t hash_value(CreateLiteralParameters const&);
 
 std::ostream& operator<<(std::ostream&, CreateLiteralParameters const&);
 
 const CreateLiteralParameters& CreateLiteralParametersOf(const Operator* op);
 
 BinaryOperationHint BinaryOperationHintOf(const Operator* op);
 
 CompareOperationHint CompareOperationHintOf(const Operator* op);
 
+VectorSlotPair const& VectorSlotPairOf(const Operator* op) WARN_UNUSED_RESULT;
+
 // Interface for building JavaScript-level operators, e.g. directly from the
 // AST. Most operators have no parameters, thus can be globally shared for all
 // graphs.
 class JSOperatorBuilder final : public ZoneObject {
  public:
   explicit JSOperatorBuilder(Zone* zone);
 
   const Operator* Equal(CompareOperationHint hint);
   const Operator* NotEqual(CompareOperationHint hint);
   const Operator* StrictEqual(CompareOperationHint hint);
@@ skipping 67 matching lines @@
                              const VectorSlotPair& feedback,
                              TypeofMode typeof_mode = NOT_INSIDE_TYPEOF);
   const Operator* StoreGlobal(LanguageMode language_mode,
                               const Handle<Name>& name,
                               const VectorSlotPair& feedback);
 
   const Operator* LoadContext(size_t depth, size_t index, bool immutable);
   const Operator* StoreContext(size_t depth, size_t index);
 
   const Operator* TypeOf();
-  const Operator* InstanceOf();
+  const Operator* InstanceOf(VectorSlotPair const& feedback);
 
   const Operator* ForInNext();
   const Operator* ForInPrepare();
 
   const Operator* LoadMessage();
   const Operator* StoreMessage();
 
   // Used to implement Ignition's SuspendGenerator bytecode.
   const Operator* GeneratorStore(int register_count);
 
@@ skipping 18 matching lines @@
   Zone* const zone_;
 
   DISALLOW_COPY_AND_ASSIGN(JSOperatorBuilder);
 };
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_COMPILER_JS_OPERATOR_H_