[turbofan] Use the instance type checker for broker's type checker.

Bug: v8:7790
Change-Id: I99c0a72c40133532acfa09cd809b695052b91ea1
Reviewed-on: https://chromium-review.googlesource.com/1156547
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54826}

src/compiler/js-heap-broker.cc

@@ -130,16 +130,21 @@ class JSGlobalProxyData : public JSObjectData {};
 class CodeData : public HeapObjectData {};
 class InternalizedStringData : public StringData {};
 
-// TODO(neis): Check serialized instance type rather than look into handle.
-#define DEFINE_IS_AND_AS(Name)                         \
-  bool ObjectData::Is##Name() const {                  \
-    AllowHandleDereference allow_handle_dereference;   \
-    return object->Is##Name();                         \
-  }                                                    \
-  Name##Data* ObjectData::As##Name() {                 \
-    CHECK_NE(broker->mode(), JSHeapBroker::kDisabled); \
-    CHECK(Is##Name());                                 \
-    return static_cast<Name##Data*>(this);             \
+#define DEFINE_IS_AND_AS(Name)                                          \
+  bool ObjectData::Is##Name() const {                                   \
+    if (broker->mode() == JSHeapBroker::kDisabled) {                    \
+      AllowHandleDereference allow_handle_dereference;                  \
+      return object->Is##Name();                                        \
+    }                                                                   \
+    if (is_smi) return false;                                           \
+    InstanceType instance_type =                                        \
+        static_cast<const HeapObjectData*>(this)->type.instance_type(); \
+    return InstanceTypeChecker::Is##Name(instance_type);                \
+  }                                                                     \
+  Name##Data* ObjectData::As##Name() {                                  \
+    CHECK_NE(broker->mode(), JSHeapBroker::kDisabled);                  \
+    CHECK(Is##Name());                                                  \
+    return static_cast<Name##Data*>(this);                              \
   }
 HEAP_BROKER_OBJECT_LIST(DEFINE_IS_AND_AS)
 #undef DEFINE_IS_AND_AS