[Interpreter] Loads accumulator before calling StoreNamedProperty in ForInAssignment.

test/cctest/interpreter/test-interpreter.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/execution.h"
 #include "src/handles.h"
 #include "src/interpreter/bytecode-array-builder.h"
 #include "src/interpreter/interpreter.h"
@@ skipping 2836 matching lines @@
        "  }\n"
        "\n"
        "  var hasOwnProperty = !teamMeeting.hasOwnProperty('name') &&\n"
        "      !teamMeeting.hasOwnProperty('startTime') &&\n"
        "      !teamMeeting.hasOwnProperty('conferenceCall');\n"
        "  if (!hasOwnProperty) {\n"
        "      flags |= 8;\n"
        "  }\n"
        "  return flags;\n"
        "  }",
-       0}};
+       0},
+      {"function f() {\n"
+       " var data = {x:23, y:34};\n"
+       " var result = 0;\n"
+       " var o = {};\n"
+       " var arr = [o];\n"
+       " for (arr[0].p in data)\n"      // This is to test if value is loaded
+       "  result += data[arr[0].p];\n"  // back from accumulator before storing
+       " return result;\n"              // named properties.
+       "}",
+       57},
+      {"function f() {\n"
+       " var data = {x:23, y:34};\n"
+       " var result = 0;\n"
+       " var o = {};\n"
+       " var i = 0;\n"
+       " for (o[i++] in data)\n"      // This is to test if value is loaded
+       "  result += data[o[i-1]];\n"  // back from accumulator before
+       " return result;\n"            // storing keyed properties.
+       "}",
+       57}};
 
   for (size_t i = 0; i < arraysize(for_in_samples); i++) {
     InterpreterTester tester(handles.main_isolate(), for_in_samples[i].first);
     auto callable = tester.GetCallable<>();
     Handle<Object> return_val = callable().ToHandleChecked();
     CHECK_EQ(Handle<Smi>::cast(return_val)->value(), for_in_samples[i].second);
   }
 }
 
 
@@ skipping 515 matching lines @@
           callable(factory->NewNumberFromInt(a)).ToHandleChecked();
       static const int results[] = {11, 12, 2};
       CHECK_EQ(Handle<Smi>::cast(return_val)->value(), results[a]);
     }
   }
 }
 
 }  // namespace interpreter
 }  // namespace internal
 }  // namespace v8