[turbofan] Optimize typeof o === "object" checks.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index ab1c6d037909c93e750cf092d0d14d97e7bd7914..4584be6edcdcfc9b1c2934418760763a5bedc63d 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -903,6 +903,13 @@ Reduction JSTypedLowering::ReduceJSEqualTypeOf(Node* node, bool invert) {
     value = graph()->NewNode(simplified()->ObjectIsCallable(), input);
   } else if (String::Equals(type, factory()->number_string())) {
     value = graph()->NewNode(simplified()->ObjectIsNumber(), input);
+  } else if (String::Equals(type, factory()->object_string())) {
+    value = graph()->NewNode(
+        common()->Select(MachineRepresentation::kTagged),
+        graph()->NewNode(simplified()->ObjectIsNonCallable(), input),
+        jsgraph()->TrueConstant(),
+        graph()->NewNode(simplified()->ReferenceEqual(), input,
+                         jsgraph()->NullConstant()));
   } else if (String::Equals(type, factory()->string_string())) {
     value = graph()->NewNode(simplified()->ObjectIsString(), input);
   } else if (String::Equals(type, factory()->undefined_string())) {