[js] Avoid %_ClassOf for collection builtins.

src/compiler/js-intrinsic-lowering.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-intrinsic-lowering.h"
 
 #include <stack>
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
@@ skipping 36 matching lines @@
     case Runtime::kInlineAsyncGeneratorResolve:
       return ReduceAsyncGeneratorResolve(node);
     case Runtime::kInlineGeneratorGetResumeMode:
       return ReduceGeneratorGetResumeMode(node);
     case Runtime::kInlineGeneratorGetContext:
       return ReduceGeneratorGetContext(node);
     case Runtime::kInlineIsArray:
       return ReduceIsInstanceType(node, JS_ARRAY_TYPE);
     case Runtime::kInlineIsTypedArray:
       return ReduceIsInstanceType(node, JS_TYPED_ARRAY_TYPE);
+    case Runtime::kInlineIsJSGlobalProxy:

[adamk, 2017/05/04 17:31:28]

You can also add these to the no-FrameState whitelist in linkage.cc

[Benedikt Meurer, 2017/05/04 17:50:53]

Good catch, done!

+      return ReduceIsInstanceType(node, JS_GLOBAL_PROXY_TYPE);
     case Runtime::kInlineIsJSProxy:
       return ReduceIsInstanceType(node, JS_PROXY_TYPE);
+    case Runtime::kInlineIsJSMap:
+      return ReduceIsInstanceType(node, JS_MAP_TYPE);
+    case Runtime::kInlineIsJSSet:
+      return ReduceIsInstanceType(node, JS_SET_TYPE);
+    case Runtime::kInlineIsJSMapIterator:
+      return ReduceIsInstanceType(node, JS_MAP_ITERATOR_TYPE);
+    case Runtime::kInlineIsJSSetIterator:
+      return ReduceIsInstanceType(node, JS_SET_ITERATOR_TYPE);
+    case Runtime::kInlineIsJSWeakMap:
+      return ReduceIsInstanceType(node, JS_WEAK_MAP_TYPE);
+    case Runtime::kInlineIsJSWeakSet:
+      return ReduceIsInstanceType(node, JS_WEAK_SET_TYPE);
     case Runtime::kInlineIsJSReceiver:
       return ReduceIsJSReceiver(node);
     case Runtime::kInlineIsSmi:
       return ReduceIsSmi(node);
     case Runtime::kInlineFixedArrayGet:
       return ReduceFixedArrayGet(node);
     case Runtime::kInlineFixedArraySet:
       return ReduceFixedArraySet(node);
     case Runtime::kInlineSubString:
       return ReduceSubString(node);
@@ skipping 410 matching lines @@
   return jsgraph_->javascript();
 }
 
 SimplifiedOperatorBuilder* JSIntrinsicLowering::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8