[turbofan] for-in only enumerates Strings.

Update type of JSForInNext to say String\/Undefined.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2660543003
Cr-Commit-Position: refs/heads/master@{#42768}

src/compiler/typer.cc

@@ -1641,7 +1641,7 @@ Type* Typer::Visitor::TypeJSConvertReceiver(Node* node) {
 
 
 Type* Typer::Visitor::TypeJSForInNext(Node* node) {
-  return Type::Union(Type::Name(), Type::Undefined(), zone());
+  return Type::Union(Type::String(), Type::Undefined(), zone());
 }