[turbofan] Fix stability checks in InferHasInPrototypeChain

While we only need to check stability of the receiver map if its
inference was "unreliable", we must check stability of each prototype's
map unconditionally.

Bug: chromium:997100
Change-Id: I20071ac9eb74c810ad2ab1d78abfb54a1a006c29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768576
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63364}

src/compiler/js-native-context-specialization.cc

@@ -521,14 +521,13 @@ JSNativeContextSpecialization::InferHasInPrototypeChain(
   bool none = true;
   for (size_t i = 0; i < receiver_maps.size(); ++i) {
     MapRef map(broker(), receiver_maps[i]);
+    if (result == NodeProperties::kUnreliableReceiverMaps && !map.is_stable()) {
+      return kMayBeInPrototypeChain;
+    }
     while (true) {
       if (IsSpecialReceiverInstanceType(map.instance_type())) {
         return kMayBeInPrototypeChain;
       }
-      if (result == NodeProperties::kUnreliableReceiverMaps &&
-          !map.is_stable()) {
-        return kMayBeInPrototypeChain;
-      }
       if (!map.IsJSObjectMap()) {
         all = false;
         break;
@@ -542,6 +541,7 @@ JSNativeContextSpecialization::InferHasInPrototypeChain(
         break;
       }
       map = map.prototype().map();
+      if (!map.is_stable()) return kMayBeInPrototypeChain;
       if (map.oddball_type() == OddballType::kNull) {
         all = false;
         break;

test/mjsunit/compiler/regress-997100.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function C() { return this };
+function foo() {
+  return new C() instanceof function(){};
+}
+%PrepareFunctionForOptimization(C);
+%PrepareFunctionForOptimization(foo);
+assertFalse(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo());