[es7] bailout Crankshaft in VisitDoExpression

For some reason, the DisableCrankshaft() in ast-numbering.cc does not always
prevent crankshaft from happening. Bailout here rather than asserting an
unreachable condition.

BUG=546967, v8:4488
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1414713004

Cr-Commit-Position: refs/heads/master@{#31537}

src/crankshaft/hydrogen.cc

@@ -5536,7 +5536,10 @@ void HOptimizedGraphBuilder::VisitNativeFunctionLiteral(
 
 
 void HOptimizedGraphBuilder::VisitDoExpression(DoExpression* expr) {
-  UNREACHABLE();
+  DCHECK(!HasStackOverflow());
+  DCHECK(current_block() != NULL);
+  DCHECK(current_block()->HasPredecessor());
+  return Bailout(kDoExpression);
 }
 
 

test/mjsunit/harmony/regress/regress-546967.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --harmony-do-expressions --allow-natives-syntax
+
+function func1() {
+  for (var i = 0; i < 64; ++i) func2();
+}
+
+%OptimizeFunctionOnNextCall(func1);
+func1();
+
+function func2() {
+  var v = do {};
+}