[WIP] Proxy fix for for-in.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 3ea1675801a3609d762f78232c83722c6879f57e..09c270375427d5e3bae4ca87e7ca7b8821984503 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -2207,21 +2207,11 @@ Reduction JSTypedLowering::ReduceJSForInPrepare(Node* node) {
   Node* efalse0;
   {
     // FixedArray case.
-    Node* receiver_instance_type = efalse0 = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
-        receiver_map, effect, if_false0);
-
-    cache_type_false0 = graph()->NewNode(
-        common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse),
-        graph()->NewNode(machine()->Word32Equal(), receiver_instance_type,
-                         jsgraph()->Uint32Constant(JS_PROXY_TYPE)),
-        jsgraph()->ZeroConstant(),  // Zero indicagtes proxy.
-        jsgraph()->OneConstant());  // One means slow check.
-
+    cache_type_false0 = jsgraph()->ZeroConstant();  // Smi means slow check
     cache_array_false0 = cache_type;
     cache_length_false0 = efalse0 = graph()->NewNode(
         simplified()->LoadField(AccessBuilder::ForFixedArrayLength()),
-        cache_array_false0, efalse0, if_false0);
+        cache_array_false0, effect, if_false0);
   }
 
   control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);