[for-in] Sanitize for-in optimizations and fix bailout points.

src/x64/macro-assembler-x64.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_X64_MACRO_ASSEMBLER_X64_H_
 #define V8_X64_MACRO_ASSEMBLER_X64_H_
 
 #include "src/assembler.h"
 #include "src/bailout-reason.h"
 #include "src/base/flags.h"
@@ skipping 1523 matching lines @@
   // Load the type feedback vector from a JavaScript frame.
   void EmitLoadTypeFeedbackVector(Register vector);
 
   // Activation support.
   void EnterFrame(StackFrame::Type type);
   void EnterFrame(StackFrame::Type type, bool load_constant_pool_pointer_reg);
   void LeaveFrame(StackFrame::Type type);
 
   // Expects object in rax and returns map with validated enum cache
   // in rax.  Assumes that any other register can be used as a scratch.
-  void CheckEnumCache(Register null_value,
-                      Label* call_runtime);
+  void CheckEnumCache(Label* call_runtime);
 
   // AllocationMemento support. Arrays may have an associated
   // AllocationMemento object that can be checked for in order to pretransition
   // to another type.
   // On entry, receiver_reg should point to the array object.
   // scratch_reg gets clobbered.
   // If allocation info is present, condition flags are set to equal.
   void TestJSArrayForAllocationMemento(Register receiver_reg,
                                        Register scratch_reg,
                                        Label* no_memento_found);
@@ skipping 184 matching lines @@
   }                                                                          \
   masm->
 #else
 #define ACCESS_MASM(masm) masm->
 #endif
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_X64_MACRO_ASSEMBLER_X64_H_