[turbofan] Fix OSR environment in for-in.

BUG=chromium:607493
LOG=n

Review-Url: https://codereview.chromium.org/1949433002
Cr-Commit-Position: refs/heads/master@{#35982}

src/compiler/ast-graph-builder.cc

@@ -1398,10 +1398,10 @@ void AstGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
         VisitIterationBody(stmt, &for_loop);
       }
       test_value.End();
-      index = environment()->Peek(0);
       for_loop.EndBody();
 
       // Increment counter and continue.
+      index = environment()->Peek(0);
       index = NewNode(javascript()->ForInStep(), index);
       environment()->Poke(0, index);
     }

test/mjsunit/compiler/regress-607493.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [1];
+
+function g() {
+  for (var x in a) {
+    try {
+      for (var i = 0; i < 10; i++) { %OptimizeOsr(); }
+      return;
+    } catch(e) {
+      continue;
+    }
+  }
+}
+
+g();