[crankshaft] Fix wrong bailout points in for-in loop body.

test/mjsunit/regress/regress-crbug-500435.js

Index: test/mjsunit/regress/regress-crbug-500435.js
diff --git a/test/mjsunit/compiler/regress-491578.js b/test/mjsunit/regress/regress-crbug-500435.js
similarity index 59%
copy from test/mjsunit/compiler/regress-491578.js
copy to test/mjsunit/regress/regress-crbug-500435.js
index c27570456c31e9a191fe1f4f1ea17b80f29de98e..acc17ac5ecce8eaa9d2c384e984c3464b80797f4 100644
--- a/test/mjsunit/compiler/regress-491578.js
+++ b/test/mjsunit/regress/regress-crbug-500435.js
@@ -4,12 +4,19 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) {
-  if (x === undefined) return;
-  while (true) {
-    while (1 || 2) { }
-    f();
+function bar(a) {
+  delete a[1];
+}
+
+function foo(a) {
+  var d;
+  for (d in a) {
+    assertFalse(d === undefined);
+    bar(a);
   }
 }
+
+foo([1,2]);
+foo([2,3]);
 %OptimizeFunctionOnNextCall(foo);
-foo();
+foo([1,2]);