[turbofan] Improve fast case of JSInstanceOf lowering.

For O instanceof C, we only need to check the instance type while
iterating the prototypes of O instead of checking both the instance
type and the access check bit of the map. This is because we have
the explicit range of "special object types", which include both
JSProxy as well as the global object and proxy and all API objects
that might have access checks or interceptors. Also restructure the
loop exits somewhat to ensure that the branch cloning gets a chance
to actually eliminate the bit materialization for the results.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2263273003
Cr-Commit-Position: refs/heads/master@{#38860}

test/unittests/compiler/js-typed-lowering-unittest.cc

@@ -1026,43 +1026,18 @@ TEST_F(JSTypedLoweringTest, JSSubtractSmis) {
 // Test that instanceOf is reduced if and only if the right-hand side is a
 // function constant. Functional correctness is ensured elsewhere.
 
-TEST_F(JSTypedLoweringTest, JSInstanceOfSpecializationWithoutSmiCheck) {
+TEST_F(JSTypedLoweringTest, JSInstanceOfSpecialization) {
   Node* const context = Parameter(Type::Any());
   Node* const frame_state = EmptyFrameState();
   Node* const effect = graph()->start();
   Node* const control = graph()->start();
 
-  // Reduce if left-hand side is known to be an object.
-  Node* instanceOf =
-      graph()->NewNode(javascript()->InstanceOf(), Parameter(Type::Object(), 0),
-                       HeapConstant(isolate()->object_function()), context,
-                       frame_state, effect, control);
-  Node* dummy = graph()->NewNode(javascript()->ToObject(), instanceOf, context,
-                                 frame_state, effect, control);
-  Reduction r = Reduce(instanceOf);
-  ASSERT_TRUE(r.Changed());
-  ASSERT_EQ(r.replacement(), dummy->InputAt(0));
-  ASSERT_NE(instanceOf, dummy->InputAt(0));
-}
-
-
-TEST_F(JSTypedLoweringTest, JSInstanceOfSpecializationWithSmiCheck) {
-  Node* const context = Parameter(Type::Any());
-  Node* const frame_state = EmptyFrameState();
-  Node* const effect = graph()->start();
-  Node* const control = graph()->start();
-
-  // Reduce if left-hand side could be a Smi.
   Node* instanceOf =
       graph()->NewNode(javascript()->InstanceOf(), Parameter(Type::Any(), 0),
                        HeapConstant(isolate()->object_function()), context,
                        frame_state, effect, control);
-  Node* dummy = graph()->NewNode(javascript()->ToObject(), instanceOf, context,
-                                 frame_state, effect, control);
   Reduction r = Reduce(instanceOf);
   ASSERT_TRUE(r.Changed());
-  ASSERT_EQ(r.replacement(), dummy->InputAt(0));
-  ASSERT_NE(instanceOf, dummy->InputAt(0));
 }