| Index: src/compiler/bytecode-graph-builder.cc | 
| diff --git a/src/compiler/bytecode-graph-builder.cc b/src/compiler/bytecode-graph-builder.cc | 
| index f4c5055ec043a9b788e0e4b61fb546bd5b5deb2d..8b926197fc4e49950e6f5762abff236f91f5db4b 100644 | 
| --- a/src/compiler/bytecode-graph-builder.cc | 
| +++ b/src/compiler/bytecode-graph-builder.cc | 
| @@ -1013,7 +1013,6 @@ void BytecodeGraphBuilder::BuildBinaryOp( | 
| Node* left = environment()->LookupRegister(iterator.GetRegisterOperand(0)); | 
| Node* right = environment()->LookupAccumulator(); | 
| Node* node = NewNode(js_op, left, right); | 
| - | 
| AddEmptyFrameStateInputs(node); | 
| environment()->BindAccumulator(node); | 
| } | 
| @@ -1369,19 +1368,58 @@ void BytecodeGraphBuilder::VisitReturn( | 
|  | 
| void BytecodeGraphBuilder::VisitForInPrepare( | 
| const interpreter::BytecodeArrayIterator& iterator) { | 
| -  UNIMPLEMENTED(); | 
| +  Node* receiver = | 
| +      environment()->LookupRegister(iterator.GetRegisterOperand(0)); | 
| +  // Prepare for-in cache. | 
| +  Node* prepare = NewNode(javascript()->ForInPrepare(), receiver); | 
| +  AddEmptyFrameStateInputs(prepare); | 
| + | 
| +  // Move cache info from ForInPrepare into interpreter frame for de-opt. | 
| +  Node* cache_type = NewNode(common()->Projection(0), prepare); | 
| +  Node* cache_array = NewNode(common()->Projection(1), prepare); | 
| +  Node* cache_length = NewNode(common()->Projection(2), prepare); | 
| +  interpreter::Register cache_type_register = iterator.GetRegisterOperand(1); | 
| +  interpreter::Register cache_array_register = iterator.GetRegisterOperand(2); | 
| +  interpreter::Register cache_length_register = iterator.GetRegisterOperand(3); | 
| +  environment()->BindRegister(cache_type_register, cache_type); | 
| +  environment()->BindRegister(cache_array_register, cache_array); | 
| +  environment()->BindRegister(cache_length_register, cache_length); | 
| +} | 
| + | 
| + | 
| +void BytecodeGraphBuilder::VisitForInDone( | 
| +    const interpreter::BytecodeArrayIterator& iterator) { | 
| +  Node* index = environment()->LookupRegister(iterator.GetRegisterOperand(0)); | 
| +  Node* cache_length = | 
| +      environment()->LookupRegister(iterator.GetRegisterOperand(1)); | 
| +  Node* exit_cond = NewNode(javascript()->ForInDone(), index, cache_length); | 
| +  AddEmptyFrameStateInputs(exit_cond); | 
| +  environment()->BindAccumulator(exit_cond); | 
| } | 
|  | 
|  | 
| void BytecodeGraphBuilder::VisitForInNext( | 
| const interpreter::BytecodeArrayIterator& iterator) { | 
| -  UNIMPLEMENTED(); | 
| +  Node* receiver = | 
| +      environment()->LookupRegister(iterator.GetRegisterOperand(0)); | 
| +  Node* cache_type = | 
| +      environment()->LookupRegister(iterator.GetRegisterOperand(1)); | 
| +  Node* cache_array = | 
| +      environment()->LookupRegister(iterator.GetRegisterOperand(2)); | 
| +  Node* index = environment()->LookupRegister(iterator.GetRegisterOperand(3)); | 
| +  Node* value = NewNode(javascript()->ForInNext(), receiver, cache_array, | 
| +                        cache_type, index); | 
| +  AddEmptyFrameStateInputs(value); | 
| +  environment()->BindAccumulator(value); | 
| } | 
|  | 
|  | 
| -void BytecodeGraphBuilder::VisitForInDone( | 
| +void BytecodeGraphBuilder::VisitForInStep( | 
| const interpreter::BytecodeArrayIterator& iterator) { | 
| -  UNIMPLEMENTED(); | 
| +  Node* index = environment()->LookupRegister(iterator.GetRegisterOperand(0)); | 
| +  index = NewNode(javascript()->ForInStep(), index); | 
| +  AddEmptyFrameStateInputs(index); | 
| +  environment()->BindRegister(iterator.GetRegisterOperand(0), index); | 
| } | 
|  | 
|  | 
|  |