Fix deoptimization at ForInStatement::BodyId()

test/mjsunit/for-in-opt.js

Index: test/mjsunit/for-in-opt.js
diff --git a/test/mjsunit/for-in-opt.js b/test/mjsunit/for-in-opt.js
index 67ef2d870e238b16c969184632563c81f9be2a3e..a6ee0ec81e32fdf965b30b831ac714bd64dbb251 100644
--- a/test/mjsunit/for-in-opt.js
+++ b/test/mjsunit/for-in-opt.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-proxies --allow-natives-syntax
+// Flags: --harmony-proxies --allow-natives-syntax --expose-debug-as debug
 
 "use strict";
 
@@ -84,3 +84,77 @@ f3({__proto__:{x:1}});
 %OptimizeFunctionOnNextCall(f3);
 f3(undefined);
 f3(null);
+
+// Reliable repro for an issue previously flushed out by GC stress.
+var handler2 = {
+  getPropertyDescriptor: function(k) {
+    has_keys.push(k);
+    return {value: 10, configurable: true, writable: false, enumerable: true};
+  }
+}
+var proxy2 = Proxy.create(handler2);
+var o2 = {__proto__: proxy2};
+var p = {x: "x"}
+
+function f4(o, p) {
+  var result = [];
+  for (var i in o) {
+    var j = p.x + "str";
+    result.push(i);
+  }
+  return result;
+}
+function check_f4() {
+  assertEquals(keys, f4(o, p));
+  assertEquals(keys, has_keys);
+  has_keys.length = 0;
+}
+check_f4();
+check_f4();
+%OptimizeFunctionOnNextCall(f4);
+p.y = "y";  // Change map, cause eager deopt.
+check_f4();
+
+// Repro for Turbofan equivalent.
+var x;
+var count = 0;
+
+var Debug = debug.Debug;
+
+function listener(event, exec_state, event_data, data) {
+  if (event == Debug.DebugEvent.Break) {
+    %DeoptimizeFunction(f5);
+  }
+}
+
+var handler3 = {
+  enumerate: function(target) {
+    return ["a", "b"];
+  },
+
+  getPropertyDescriptor: function(k) {
+    if (k == "a") count++;
+    if (x) %ScheduleBreak();
+    return {value: 10, configurable: true, writable: false, enumerable: true};
+  }
+};
+
+var proxy3 = Proxy.create(handler3);
+var o3 = {__proto__: proxy3};
+
+function f5() {
+  for (var p in o3) {
+    print(p);
+  }
+}
+
+x = false;
+
+f5(); f5(); f5();
+%OptimizeFunctionOnNextCall(f5);
+x = true;
+count = 0;
+Debug.setListener(listener);
+f5();
+Debug.setListener(null);
+assertEquals(1, count);