generateConditionsForInstanceOf needs to see if the object has a poly proto structure...

generateConditionsForInstanceOf needs to see if the object has a poly proto structure before assuming it has a constant prototype
https://bugs.webkit.org/show_bug.cgi?id=186363

Rubber-stamped by Filip Pizlo.

JSTests:

* stress/instance-of-on-poly-proto-opc-should-not-crash.js: Added.

Source/JavaScriptCore:

The code was assuming that the object it was creating an OPC for always
had a non-poly-proto structure. However, this assumption was wrong. For
example, an object in the prototype chain could be poly proto. That type
of object graph would cause a crash in this code. This patch makes it so
that we fail to generate an ObjectPropertyConditionSet if we see a poly proto
object as we traverse the prototype chain.

* bytecode/ObjectPropertyConditionSet.cpp:
(JSC::generateConditionsForInstanceOf):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232562 268f45cc-cd09-0410-ab3c-d52691b4dbfc