Version 4.4.63.26

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index a1b06482078471d937ca46e7efb70323e06bc325..6a86c736ee5e63208e697fc5e114ecf4d24844b0 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5219,9 +5219,12 @@ void HOptimizedGraphBuilder::BuildForInBody(ForInStatement* stmt,
     HValue* function = AddLoadJSBuiltin(Builtins::FILTER_KEY);
     Add<HPushArguments>(enumerable, key);
     key = Add<HInvokeFunction>(function, 2);
+    Push(key);
+    Add<HSimulate>(stmt->FilterId());
+    key = Pop();
     Bind(each_var, key);
-    Add<HSimulate>(stmt->AssignmentId());
     Add<HCheckHeapObject>(key);
+    Add<HSimulate>(stmt->AssignmentId());
   }
 
   BreakAndContinueInfo break_info(stmt, scope(), 5);