Fix assertion failure in JSBuiltinReducer::ReduceArrayIterator.

TBR=bmeurer@chromium.org
BUG=chromium:671576

Review-Url: https://codereview.chromium.org/2550143004
Cr-Commit-Position: refs/heads/master@{#41518}

src/contexts.h

@@ -120,9 +120,9 @@ enum ContextLookupFlags {
   V(WASM_RUNTIME_ERROR_FUNCTION_INDEX, JSFunction, wasm_runtime_error_function)
 
 #define NATIVE_CONTEXT_JS_ARRAY_ITERATOR_MAPS(V)                               \
+  V(TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, typed_array_key_iterator_map)     \
   V(FAST_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, fast_array_key_iterator_map)       \
   V(GENERIC_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, array_key_iterator_map)         \
-  V(TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, typed_array_key_iterator_map)     \
                                                                                \
   V(UINT8_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                             \
     uint8_array_key_value_iterator_map)                                        \

test/mjsunit/regress/regress-crbug-671576.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  for (var i of [NaN].keys());
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();