[crankshaft] Fix wrong bailout points in for-in loop body.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 12decb0a231487f226794b0598cb34f087baf229..945bf11d5adaf33555fd9a6c22186c46ec0e5301 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5210,13 +5210,16 @@ void HOptimizedGraphBuilder::BuildForInBody(ForInStatement* stmt,
     Runtime::FunctionId function_id = Runtime::kForInFilter;
     key = Add<HCallRuntime>(isolate()->factory()->empty_string(),
                             Runtime::FunctionForId(function_id), 2);
+    Push(key);
+    Add<HSimulate>(stmt->FilterId());
+    key = Pop();
     Bind(each_var, key);
-    Add<HSimulate>(stmt->AssignmentId());
     IfBuilder if_undefined(this);
     if_undefined.If<HCompareObjectEqAndBranch>(key,
                                                graph()->GetConstantUndefined());
     if_undefined.ThenDeopt(Deoptimizer::kUndefined);
     if_undefined.End();
+    Add<HSimulate>(stmt->AssignmentId());
   }
 
   BreakAndContinueInfo break_info(stmt, scope(), 5);