Port 1915762c

Original commit message:

    These JavaScript operators were special hacks to ensure that we always
    operate on Smis for the magic for-in index variable, but this never
    really worked in the OSR case, because the OsrValue for the index
    variable didn't have the proper information (that we have for the
    JSForInPrepare in the non-OSR case).

    Now that we have loop induction variable analysis and binary operation
    hints, we can just use JSLessThan and JSAdd instead with appropriate
    Smi hints, which handle the OSR case by inserting Smi checks (that are
    always true). Thanks to OSR deconstruction and loop peeling these Smi
    checks will be hoisted so they don't hurt the OSR case too much.

    Drive-by-change: Rename the ForInDone bytecode to ForInContinue, since
    we have to lower it to JSLessThan to get the loop induction variable
    goodness.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2502503002
Cr-Commit-Position: refs/heads/master@{#40947}