Fix scopes for body of sloppy-mode for-in/of loop

test/mjsunit/regress/regress-542099.js

Index: test/mjsunit/regress/regress-542099.js
diff --git a/test/mjsunit/regress/regress-542099.js b/test/mjsunit/regress/regress-542099.js
new file mode 100644
index 0000000000000000000000000000000000000000..f3655da53cd180899130520baa87b861aaa63a0e
--- /dev/null
+++ b/test/mjsunit/regress/regress-542099.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-sloppy --harmony-sloppy-function
+
+// Previously, this caused a CHECK fail in debug mode
+// https://code.google.com/p/chromium/issues/detail?id=542099
+
+var foo = {};
+var bar = foo;
+for (foo.x in {a: 1}) function foo() { return foo; }
+assertEquals("object", typeof bar);
+assertEquals("a", bar.x);
+assertEquals("function", typeof foo);
+assertEquals("function", typeof foo());
+assertSame(foo, foo());
+assertEquals(undefined, foo.x);