[for-in] Sanitize for-in optimizations and fix bailout points.

src/arm64/macro-assembler-arm64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_ARM64
 
 #include "src/base/bits.h"
 #include "src/base/division-by-constant.h"
 #include "src/bootstrapper.h"
 #include "src/codegen.h"
@@ skipping 1470 matching lines @@
   Ldr(dst, FieldMemOperand(holder, HeapObject::kMapOffset));
   LoadInstanceDescriptors(dst, dst);
   Ldr(dst,
       FieldMemOperand(dst, DescriptorArray::GetValueOffset(accessor_index)));
   int offset = accessor == ACCESSOR_GETTER ? AccessorPair::kGetterOffset
                                            : AccessorPair::kSetterOffset;
   Ldr(dst, FieldMemOperand(dst, offset));
 }
 
 
-void MacroAssembler::CheckEnumCache(Register object,
-                                    Register null_value,
-                                    Register scratch0,
-                                    Register scratch1,
-                                    Register scratch2,
-                                    Register scratch3,
+void MacroAssembler::CheckEnumCache(Register object, Register scratch0,
+                                    Register scratch1, Register scratch2,
+                                    Register scratch3, Register scratch4,
                                     Label* call_runtime) {
-  DCHECK(!AreAliased(object, null_value, scratch0, scratch1, scratch2,
-                     scratch3));
+  DCHECK(!AreAliased(object, scratch0, scratch1, scratch2, scratch3, scratch4));
 
   Register empty_fixed_array_value = scratch0;
   Register current_object = scratch1;
+  Register null_value = scratch4;
 
   LoadRoot(empty_fixed_array_value, Heap::kEmptyFixedArrayRootIndex);
   Label next, start;
 
   Mov(current_object, object);
 
   // Check if the enum length field is properly initialized, indicating that
   // there is an enum cache.
   Register map = scratch2;
   Register enum_length = scratch3;
   Ldr(map, FieldMemOperand(current_object, HeapObject::kMapOffset));
 
   EnumLengthUntagged(enum_length, map);
   Cmp(enum_length, kInvalidEnumCacheSentinel);
   B(eq, call_runtime);
 
+  LoadRoot(null_value, Heap::kNullValueRootIndex);
   B(&start);
 
   Bind(&next);
   Ldr(map, FieldMemOperand(current_object, HeapObject::kMapOffset));
 
   // For all objects but the receiver, check that the cache is empty.
   EnumLengthUntagged(enum_length, map);
   Cbnz(enum_length, call_runtime);
 
   Bind(&start);
@@ skipping 3358 matching lines @@
 }
 
 
 #undef __
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_ARM64