[crankshaft] Fix wrong bailout points in for-in loop body.

R=jochen@chromium.org
BUG=chromium:500435
LOG=y

Review URL: https://codereview.chromium.org/1183683004

Cr-Commit-Position: refs/heads/master@{#29040}

src/hydrogen.cc

@@ -5210,13 +5210,16 @@ void HOptimizedGraphBuilder::BuildForInBody(ForInStatement* stmt,
     Runtime::FunctionId function_id = Runtime::kForInFilter;
     key = Add<HCallRuntime>(isolate()->factory()->empty_string(),
                             Runtime::FunctionForId(function_id), 2);
+    Push(key);
+    Add<HSimulate>(stmt->FilterId());
+    key = Pop();
     Bind(each_var, key);
-    Add<HSimulate>(stmt->AssignmentId());
     IfBuilder if_undefined(this);
     if_undefined.If<HCompareObjectEqAndBranch>(key,
                                                graph()->GetConstantUndefined());
     if_undefined.ThenDeopt(Deoptimizer::kUndefined);
     if_undefined.End();
+    Add<HSimulate>(stmt->AssignmentId());
   }
 
   BreakAndContinueInfo break_info(stmt, scope(), 5);

test/mjsunit/regress/regress-crbug-500435.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(a) {
+  delete a[1];
+}
+
+function foo(a) {
+  var d;
+  for (d in a) {
+    assertFalse(d === undefined);
+    bar(a);
+  }
+}
+
+foo([1,2]);
+foo([2,3]);
+%OptimizeFunctionOnNextCall(foo);
+foo([1,2]);