[compiler] Properly guard the speculative optimizations for instanceof.

test/mjsunit/compiler/deopt-instanceof-proxy.js

Index: test/mjsunit/compiler/deopt-instanceof-proxy.js
diff --git a/test/mjsunit/regress/regress-5404.js b/test/mjsunit/compiler/deopt-instanceof-proxy.js
similarity index 61%
copy from test/mjsunit/regress/regress-5404.js
copy to test/mjsunit/compiler/deopt-instanceof-proxy.js
index 652db4bdb5d57d159935f790d34709a6cf029f90..e9a1a98336035125a72e8b333a6901223b8e39cb 100644
--- a/test/mjsunit/regress/regress-5404.js
+++ b/test/mjsunit/compiler/deopt-instanceof-proxy.js
@@ -4,18 +4,21 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(a, b) {
-  return a + "0123456789012";
+function A() {}
+
+function foo(a) {
+  return a instanceof A;
 }
 
-foo("a");
-foo("a");
+var a = new A;
+var p = new Proxy(a, {});
+foo(a);
+foo(a);
 %OptimizeFunctionOnNextCall(foo);
-foo("a");
-
-var a = "a".repeat(268435440);
-assertThrows(function() { foo(a); });
-
+foo(a);
+assertOptimized(foo);
+foo(p);
+foo(p);
 %OptimizeFunctionOnNextCall(foo);
-assertThrows(function() { foo(a); });
+foo(p);
 assertOptimized(foo);