Fix scopes for body of sloppy-mode for-in/of loop

test/mjsunit/regress/regress-542099.js

Index: test/mjsunit/regress/regress-542099.js
diff --git a/test/mjsunit/regress/regress-542099.js b/test/mjsunit/regress/regress-542099.js
new file mode 100644
index 0000000000000000000000000000000000000000..13af3798d3ccbe266ffbd81deb60a543a3f64fbc
--- /dev/null
+++ b/test/mjsunit/regress/regress-542099.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-sloppy --harmony-sloppy-function
+
+// Previously, this caused a CHECK fail in debug mode
+// https://code.google.com/p/chromium/issues/detail?id=542099
+
+var foo = {};
+var bar = foo;
+for (foo.x in {a: 1}) function foo() { return foo; }
+assertEquals("object", typeof bar);
+assertEquals("a", bar.x);
+assertEquals("function", typeof foo);
+assertEquals("function", typeof foo());

[rossberg, 2015/10/13 15:21:18]

How about adding

assertSame(foo, foo());

+assertEquals(undefined, foo.x);