From e6ff184457db4d7726639c61d69dd80f44a8ad5e Mon Sep 17 00:00:00 2001
From: Michael Starzinger <mstarzinger@google.com>
Date: Fri, 23 Sep 2016 10:31:50 +0200
Subject: [PATCH] Merged: [turbofan] Fix loop assignment analysis on
 ForInStatements.

Revision: 4dab7b5a1d6722002d47d0be2481cb65602a2451

BUG=chromium:647887
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bmeurer@chromium.org, hablich@chromium.org

Review URL: https://codereview.chromium.org/2364843002 .

Cr-Commit-Position: refs/branch-heads/5.4@{#55}
Cr-Branched-From: 5ce282769772d94937eb2cb88eb419a6890c8b2d-refs/heads/5.4.500@{#2}
Cr-Branched-From: ad07b49d7b47b40a2d6f74d04d1b76ceae2a0253-refs/heads/master@{#38841}
---
 src/compiler/ast-loop-assignment-analyzer.cc |  4 +++-
 test/mjsunit/regress/regress-crbug-647887.js | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 test/mjsunit/regress/regress-crbug-647887.js

diff --git a/src/compiler/ast-loop-assignment-analyzer.cc b/src/compiler/ast-loop-assignment-analyzer.cc
index 22438c720a8..f1469f76f75 100644
--- a/src/compiler/ast-loop-assignment-analyzer.cc
+++ b/src/compiler/ast-loop-assignment-analyzer.cc
@@ -252,10 +252,12 @@ void ALAA::VisitForStatement(ForStatement* loop) {
 
 
 void ALAA::VisitForInStatement(ForInStatement* loop) {
+  Expression* l = loop->each();
   Enter(loop);
-  Visit(loop->each());
+  Visit(l);
   Visit(loop->subject());
   Visit(loop->body());
+  if (l->IsVariableProxy()) AnalyzeAssignment(l->AsVariableProxy()->var());
   Exit(loop);
 }
 
diff --git a/test/mjsunit/regress/regress-crbug-647887.js b/test/mjsunit/regress/regress-crbug-647887.js
new file mode 100644
index 00000000000..84e598d5aa9
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-647887.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(obj) {
+  var key;
+  for (key in obj) { }
+  return key === undefined;
+}
+
+%OptimizeFunctionOnNextCall(f);
+assertFalse(f({ foo:0 }));