[test] Increase for..in test coverage for optimized code.

Bug: v8:6702
Change-Id: I6e2fc1a56035b9841ad5c71504b74a89d7259ad1
Reviewed-on: https://chromium-review.googlesource.com/651366Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47851}

test/mjsunit/compiler/for-in-1.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Ensure that we properly check for elements on the receiver.
+function foo(o) {
+  var s = "";
+  for (var i in o) s += i;
+  return s;
+}
+
+var a = [];
+assertEquals("", foo(a));
+assertEquals("", foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("", foo(a));
+a[0] = 1;
+assertEquals("0", foo(a));

test/mjsunit/compiler/for-in-2.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Ensure that we properly check for elements on the prototypes.
+function foo(o) {
+  var s = "";
+  for (var i in o) s += i;
+  return s;
+}
+
+var a = [];
+assertEquals("", foo(a));
+assertEquals("", foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("", foo(a));
+Array.prototype[0] = 1;
+assertEquals("0", foo(a));

test/mjsunit/compiler/for-in-3.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Ensure that we properly check for elements on the prototypes.
+function foo(o) {
+  var s = "";
+  for (var i in o) s += i;
+  return s;
+}
+
+var o = {};
+assertEquals("", foo(o));
+assertEquals("", foo(o));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("", foo(o));
+Object.prototype[0] = 1;
+assertEquals("0", foo(o));

test/mjsunit/compiler/for-in-4.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Ensure that we properly check for properties on the prototypes.
+function foo(o) {
+  var s = "";
+  for (var i in o) s += i;
+  return s;
+}
+
+var a = [];
+assertEquals("", foo(a));
+assertEquals("", foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("", foo(a));
+Array.prototype.x = 4;
+assertEquals("x", foo(a));

test/mjsunit/compiler/for-in-5.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Ensure that we properly check for properties on the prototypes.
+function foo(o) {
+  var s = "";
+  for (var i in o) s += i;
+  return s;
+}
+var o = {a:1, b:2, c:3};
+assertEquals("abc", foo(o));
+assertEquals("abc", foo(o));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("abc", foo(o));
+Object.prototype.d = 4;
+assertEquals("abcd", foo(o));