Merged: [turbofan] Fix loop assignment analysis on ForInStatements.

Revision: 4dab7b5

BUG=chromium:647887
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bmeurer@chromium.org, hablich@chromium.org

Review URL: https://codereview.chromium.org/2364843002 .

Cr-Commit-Position: refs/branch-heads/5.4@{#55}
Cr-Branched-From: 5ce2827-refs/heads/5.4.500@{#2}
Cr-Branched-From: ad07b49-refs/heads/master@{#38841}

src/compiler/ast-loop-assignment-analyzer.cc

@@ -252,10 +252,12 @@ void ALAA::VisitForStatement(ForStatement* loop) {
 
 
 void ALAA::VisitForInStatement(ForInStatement* loop) {
+  Expression* l = loop->each();
   Enter(loop);
-  Visit(loop->each());
+  Visit(l);
   Visit(loop->subject());
   Visit(loop->body());
+  if (l->IsVariableProxy()) AnalyzeAssignment(l->AsVariableProxy()->var());
   Exit(loop);
 }
 

test/mjsunit/regress/regress-crbug-647887.js

@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(obj) {
+  var key;
+  for (key in obj) { }
+  return key === undefined;
+}
+
+%OptimizeFunctionOnNextCall(f);
+assertFalse(f({ foo:0 }));