[runtime] Make sure %ForInPrepare returns the correct length.

src/runtime/runtime-forin.cc

Index: src/runtime/runtime-forin.cc
diff --git a/src/runtime/runtime-forin.cc b/src/runtime/runtime-forin.cc
index df1e975484e27b708c0bb5e23324943899a2dda3..e6c9cca20f341349774da3a12e72eb41b7c438de 100644
--- a/src/runtime/runtime-forin.cc
+++ b/src/runtime/runtime-forin.cc
@@ -31,16 +31,13 @@ RUNTIME_FUNCTION_RETURN_TRIPLE(Runtime_ForInPrepare) {
   Handle<FixedArray> cache_array;
   int cache_length;
 
-  Handle<Map> receiver_map = handle(receiver->map(), isolate);
   if (cache_type->IsMap()) {
-    Handle<Map> cache_type_map =
-        handle(Handle<Map>::cast(cache_type)->map(), isolate);
-    DCHECK(cache_type_map.is_identical_to(isolate->factory()->meta_map()));
-    int enum_length = cache_type_map->EnumLength();
-    DescriptorArray* descriptors = receiver_map->instance_descriptors();
-    if (enum_length > 0 && descriptors->HasEnumCache()) {
+    Handle<Map> cache_type_map = Handle<Map>::cast(cache_type);
+    int const enum_length = cache_type_map->EnumLength();
+    DescriptorArray* descriptors = cache_type_map->instance_descriptors();
+    if (enum_length && descriptors->HasEnumCache()) {
       cache_array = handle(descriptors->GetEnumCache(), isolate);
-      cache_length = cache_array->length();
+      cache_length = enum_length;
     } else {
       cache_array = isolate->factory()->empty_fixed_array();
       cache_length = 0;