[compiler] Properly guard the speculative optimizations for instanceof.

src/compiler/js-operator.cc

Index: src/compiler/js-operator.cc
diff --git a/src/compiler/js-operator.cc b/src/compiler/js-operator.cc
index d39f8cdac57c4a0530064297013d30ae17e79516..f87b34a0af3f543d4265ee7e0549b3e54e2c0b0f 100644
--- a/src/compiler/js-operator.cc
+++ b/src/compiler/js-operator.cc
@@ -39,6 +39,14 @@ size_t hash_value(VectorSlotPair const& p) {
   return base::hash_combine(p.slot(), p.vector().location());
 }
 
+std::ostream& operator<<(std::ostream& os, VectorSlotPair const& p) {
+  if (p.IsValid()) {
+    os << p.index();
+  } else {
+    os << "N/A";
+  }
+  return os;
+}
 
 ConvertReceiverMode ConvertReceiverModeOf(Operator const* op) {
   DCHECK_EQ(IrOpcode::kJSConvertReceiver, op->opcode());
@@ -436,6 +444,11 @@ CompareOperationHint CompareOperationHintOf(const Operator* op) {
   return OpParameter<CompareOperationHint>(op);
 }
 
+VectorSlotPair const& VectorSlotPairOf(const Operator* op) {
+  DCHECK_EQ(IrOpcode::kJSInstanceOf, op->opcode());
+  return OpParameter<VectorSlotPair>(op);
+}
+
 #define CACHED_OP_LIST(V)                                   \
   V(ToInteger, Operator::kNoProperties, 1, 1)               \
   V(ToLength, Operator::kNoProperties, 1, 1)                \
@@ -447,7 +460,6 @@ CompareOperationHint CompareOperationHintOf(const Operator* op) {
   V(CreateIterResultObject, Operator::kEliminatable, 2, 1)  \
   V(HasProperty, Operator::kNoProperties, 2, 1)             \
   V(TypeOf, Operator::kPure, 1, 1)                          \
-  V(InstanceOf, Operator::kNoProperties, 2, 1)              \
   V(ForInNext, Operator::kNoProperties, 4, 1)               \
   V(ForInPrepare, Operator::kNoProperties, 1, 3)            \
   V(LoadMessage, Operator::kNoThrow, 0, 1)                  \
@@ -765,6 +777,13 @@ const Operator* JSOperatorBuilder::StoreContext(size_t depth, size_t index) {
       access);                                   // parameter
 }
 
+const Operator* JSOperatorBuilder::InstanceOf(VectorSlotPair const& feedback) {
+  return new (zone()) Operator1<VectorSlotPair>(         // --
+      IrOpcode::kJSInstanceOf, Operator::kNoProperties,  // opcode
+      "JSInstanceOf",                                    // name
+      2, 1, 1, 1, 1, 2,                                  // counts
+      feedback);                                         // parameter
+}
 
 const Operator* JSOperatorBuilder::CreateArguments(CreateArgumentsType type) {
   return new (zone()) Operator1<CreateArgumentsType>(         // --