X87: InstanceOfStub incorrectly interprets the hole as a prototype.

  port 2aa070be (r34863)

  original commit message:
  Repair this to match what the runtime correctly does, by first checking if the
  function is a constructor before we access the prototype.

BUG=

Review URL: https://codereview.chromium.org/1809333002

Cr-Commit-Position: refs/heads/master@{#34880}

src/x87/code-stubs-x87.cc

@@ -1862,6 +1862,11 @@ void InstanceOfStub::Generate(MacroAssembler* masm) {
   __ CmpObjectType(function, JS_FUNCTION_TYPE, function_map);
   __ j(not_equal, &slow_case);
 
+  // Go to the runtime if the function is not a constructor.
+  __ test_b(FieldOperand(function_map, Map::kBitFieldOffset),
+            static_cast<uint8_t>(1 << Map::kIsConstructor));
+  __ j(zero, &slow_case);
+
   // Ensure that {function} has an instance prototype.
   __ test_b(FieldOperand(function_map, Map::kBitFieldOffset),
             static_cast<uint8_t>(1 << Map::kHasNonInstancePrototype));