X87: [turbofan] Remove special JSForInStep and JSForInDone.

  port 1915762c (r38968)

  original commit message:
  These JavaScript operators were special hacks to ensure that we always
  operate on Smis for the magic for-in index variable, but this never
  really worked in the OSR case, because the OsrValue for the index
  variable didn't have the proper information (that we have for the
  JSForInPrepare in the non-OSR case).

  Now that we have loop induction variable analysis and binary operation
  hints, we can just use JSLessThan and JSAdd instead with appropriate
  Smi hints, which handle the OSR case by inserting Smi checks (that are
  always true). Thanks to OSR deconstruction and loop peeling these Smi
  checks will be hoisted so they don't hurt the OSR case too much.

  Drive-by-change: Rename the ForInDone bytecode to ForInContinue, since
  we have to lower it to JSLessThan to get the loop induction variable
  goodness.

BUG=

Review-Url: https://codereview.chromium.org/2286353003
Cr-Commit-Position: refs/heads/master@{#38992}

src/full-codegen/x87/full-codegen-x87.cc

@@ -1052,6 +1052,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   // Generate code for going to the next element by incrementing the
   // index (smi) stored on top of the stack.
   __ bind(loop_statement.continue_label());
+  PrepareForBailoutForId(stmt->IncrementId(), BailoutState::NO_REGISTERS);
   __ add(Operand(esp, 0 * kPointerSize), Immediate(Smi::FromInt(1)));
 
   EmitBackEdgeBookkeeping(stmt, &loop);