[compiler] Improve let+const decision in AstNumbering.

Incooperate suggestion from adamk@ to only sent lexical variables to
I+TF that require explicit initialization, i.e. don't send named
function expressions to I+TF. This should recover most of the regression
now.

Also introduce a regression test for the original let issue.

BUG=chromium:670691,v8:5666
R=adamk@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2556663002
Cr-Commit-Position: refs/heads/master@{#41507}

src/ast/ast-numbering.cc

@@ -161,7 +161,10 @@ void AstNumberingVisitor::VisitVariableProxyReference(VariableProxy* node) {
     default:
       break;
   }
-  if (IsLexicalVariableMode(node->var()->mode())) {
+  if (node->var()->binding_needs_init()) {
+    // Disable FCG+CS for all variable bindings that need explicit
+    // initialization, i.e. ES2015 style const and let, but not
+    // named function expressions.
     DisableFullCodegenAndCrankshaft(kReferenceToLetOrConstVariable);
   }
   node->set_base_id(ReserveIdRange(VariableProxy::num_ids()));

test/mjsunit/regress/regress-v8-5666.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(j) {
+  for (var i = 0; i < j + 1; i++) {
+    if (i === j) %OptimizeOsr();
+  }
+  let k = 1
+}
+
+foo(1000);
+foo(1000);
+%OptimizeFunctionOnNextCall(foo);
+foo(-1);
+assertOptimized(foo);