[Interpreter] Implement ForIn in bytecode graph builder.

src/runtime/runtime-interpreter.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/isolate-inl.h"
 
 namespace v8 {
@@ skipping 167 matching lines @@
     STATIC_ASSERT(JS_PROXY_TYPE == FIRST_JS_RECEIVER_TYPE);
     if (receiver_map->instance_type() == JS_PROXY_TYPE) {
       // Zero indicates proxy
       cache_type = Handle<Object>(Smi::FromInt(0), isolate);
     } else {
       // One entails slow check
       cache_type = Handle<Object>(Smi::FromInt(1), isolate);
     }
   }
 
-  Handle<FixedArray> result = isolate->factory()->NewFixedArray(4);
-  result->set(0, *receiver);
+  Handle<FixedArray> result = isolate->factory()->NewFixedArray(3);
+  result->set(0, *cache_type);
   result->set(1, *cache_array);
-  result->set(2, *cache_type);
-  result->set(3, Smi::FromInt(cache_length));
+  result->set(2, Smi::FromInt(cache_length));
   return *result;
 }
 
-
 }  // namespace internal
 }  // namespace v8