X87: [crankshaft] Deoptimize if HHasInPrototypeChainAndBranch hits a proxy.

  port a330af0e (r32539)

  original commit message:
  The optimized code generated by Crankshaft cannot properly deal
  with proxies (in the prototype chain), and there's probably no
  point in trying to make that work^Wfast with Crankshaft at all.
  TurboFan will handle that properly; Crankshaft just bails out
  to fullcodegen, which then goes to the runtime, which should do
  the right thing soon.

BUG=

Review URL: https://codereview.chromium.org/1495803003

Cr-Commit-Position: refs/heads/master@{#32594}

src/crankshaft/x87/lithium-codegen-x87.cc

@@ -2880,6 +2880,8 @@ void LCodeGen::DoHasInPrototypeChainAndBranch(
   __ mov(object_map, FieldOperand(object, HeapObject::kMapOffset));
   Label loop;
   __ bind(&loop);
+  __ CmpInstanceType(object_map, JS_PROXY_TYPE);
+  DeoptimizeIf(equal, instr, Deoptimizer::kProxy);
   __ mov(object_prototype, FieldOperand(object_map, Map::kPrototypeOffset));
   __ cmp(object_prototype, prototype);
   EmitTrueBranch(instr, equal);

src/crankshaft/x87/lithium-x87.cc

@@ -1038,7 +1038,9 @@ LInstruction* LChunkBuilder::DoHasInPrototypeChainAndBranch(
   LOperand* object = UseRegister(instr->object());
   LOperand* prototype = UseRegister(instr->prototype());
   LOperand* temp = TempRegister();
-  return new (zone()) LHasInPrototypeChainAndBranch(object, prototype, temp);
+  LHasInPrototypeChainAndBranch* result =
+      new (zone()) LHasInPrototypeChainAndBranch(object, prototype, temp);
+  return AssignEnvironment(result);
 }