HGraphBuilder::BuildJSObjectCheck: Tighten instance type comparison

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index d21541b281c6b5d9a6aa6a10e1d0c74abf06ad18..954cb627d2a728f6fbab71766ab8606ef2901bc8 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -1431,7 +1431,8 @@ void HGraphBuilder::BuildJSObjectCheck(HValue* receiver,
                                              mask);
   HValue* sub_result = AddUncasted<HSub>(and_result,
                                          Add<HConstant>(JS_OBJECT_TYPE));
-  Add<HBoundsCheck>(sub_result, Add<HConstant>(0x100 - JS_OBJECT_TYPE));
+  Add<HBoundsCheck>(sub_result,
+                    Add<HConstant>(LAST_JS_OBJECT_TYPE + 1 - JS_OBJECT_TYPE));
 }