Fix scopes for body of sloppy-mode for-in/of loop

test/mjsunit/regress/regress-542099.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-sloppy --harmony-sloppy-function
+
+// Previously, this caused a CHECK fail in debug mode
+// https://code.google.com/p/chromium/issues/detail?id=542099
+
+var foo = {};
+var bar = foo;
+for (foo.x in {a: 1}) function foo() { return foo; }
+assertEquals("object", typeof bar);
+assertEquals("a", bar.x);
+assertEquals("function", typeof foo);
+assertEquals("function", typeof foo());
+assertSame(foo, foo());
+assertEquals(undefined, foo.x);