[turbofan] Properly optimize instanceof (even in the presence of @@hasInstance).

test/unittests/compiler/js-typed-lowering-unittest.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-typed-lowering.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
@@ skipping 842 matching lines @@
   Node* control = graph()->start();
   Reduction r = Reduce(graph()->NewNode(javascript()->Subtract(hint), lhs, rhs,
                                         context, frame_state, effect, control));
   ASSERT_TRUE(r.Changed());
   EXPECT_THAT(r.replacement(),
               IsSpeculativeNumberSubtract(NumberOperationHint::kSignedSmall,
                                           lhs, rhs, effect, control));
 }
 
 // -----------------------------------------------------------------------------
-// JSInstanceOf
-// Test that instanceOf is reduced if and only if the right-hand side is a
-// function constant. Functional correctness is ensured elsewhere.
-
-TEST_F(JSTypedLoweringTest, JSInstanceOfSpecialization) {
-  Node* const context = Parameter(Type::Any());
-  Node* const frame_state = EmptyFrameState();
-  Node* const effect = graph()->start();
-  Node* const control = graph()->start();
-
-  Node* instanceOf =
-      graph()->NewNode(javascript()->InstanceOf(), Parameter(Type::Any(), 0),
-                       HeapConstant(isolate()->object_function()), context,
-                       frame_state, effect, control);
-  Reduction r = Reduce(instanceOf);
-  ASSERT_TRUE(r.Changed());
-}
-
-
-TEST_F(JSTypedLoweringTest, JSInstanceOfNoSpecialization) {
-  Node* const context = Parameter(Type::Any());
-  Node* const frame_state = EmptyFrameState();
-  Node* const effect = graph()->start();
-  Node* const control = graph()->start();
-
-  // Do not reduce if right-hand side is not a function constant.
-  Node* instanceOf = graph()->NewNode(
-      javascript()->InstanceOf(), Parameter(Type::Any(), 0),
-      Parameter(Type::Any()), context, frame_state, effect, control);
-  Node* dummy = graph()->NewNode(javascript()->ToObject(), instanceOf, context,
-                                 frame_state, effect, control);
-  Reduction r = Reduce(instanceOf);
-  ASSERT_FALSE(r.Changed());
-  ASSERT_EQ(instanceOf, dummy->InputAt(0));
-}
-
-// -----------------------------------------------------------------------------
 // JSBitwiseAnd
 
 TEST_F(JSTypedLoweringTest, JSBitwiseAndWithSignedSmallHint) {
   BinaryOperationHint const hint = BinaryOperationHint::kSignedSmall;
   Node* lhs = Parameter(Type::Number(), 2);
   Node* rhs = Parameter(Type::Number(), 3);
   Node* effect = graph()->start();
   Node* control = graph()->start();
   Reduction r = Reduce(graph()->NewNode(javascript()->BitwiseAnd(hint), lhs,
                                         rhs, UndefinedConstant(),
@@ skipping 126 matching lines @@
                                         EmptyFrameState(), effect, control));
   ASSERT_TRUE(r.Changed());
   EXPECT_THAT(r.replacement(), IsSpeculativeNumberBitwiseXor(
                                    NumberOperationHint::kNumberOrOddball, lhs,
                                    rhs, effect, control));
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8