[turbofan] Fix --turbo-osr for OSRing into inner loop inside for-in.

R=mstarzinger@chromium.org
BUG=chromium:462775
LOG=Y

Review URL: https://codereview.chromium.org/988423003

Cr-Commit-Position: refs/heads/master@{#27088}

src/compiler/ast-graph-builder.cc

@@ -1194,7 +1194,9 @@ void AstGraphBuilder::VisitForInBody(ForInStatement* stmt) {
   // Bind value and do loop body.
   VisitForInAssignment(stmt->each(), value, stmt->AssignmentId());
   VisitIterationBody(stmt, &for_loop);
+  index = environment()->Peek(0);
   for_loop.EndBody();
+
   // Inc counter and continue.
   Node* index_inc =
       NewNode(javascript()->Add(), index, jsgraph()->OneConstant());

test/mjsunit/compiler/osr-forin-nested.js

@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-osr --allow-natives-syntax
+
+function test(e, f, v) {
+  assertEquals(e, f(v));
+  assertEquals(e, f(v));
+  assertEquals(e, f(v));
+}
+
+function foo(t) {
+  for (var x in t) {
+    for (var i = 0; i < 2; i++) {
+      %OptimizeOsr();
+    }
+  }
+  return 5;
+}
+
+test(5, foo, {x:20});
+
+function bar(t) {
+  var sum = 0;
+  for (var x in t) {
+    for (var i = 0; i < 2; i++) {
+      %OptimizeOsr();
+      sum += t[x];
+    }
+  }
+  return sum;
+}
+
+test(62, bar, {x:20,y:11});