[turbofan] Switch JSForInPrepare to %ForInPrepare style.

src/compiler/typer.cc

Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 7e36f0a315b1f796d36346f276bc52d4f494d2b4..1024f0a25dbafb0e7a3a5d5f8a3dfae2cf934a08 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -650,6 +650,11 @@ Type* Typer::Visitor::TypeCall(Node* node) { return Type::Any(); }
 
 
 Type* Typer::Visitor::TypeProjection(Node* node) {
+  // TODO(bmeurer): Make this beautiful! Use tuple type here.
+  if (node->InputAt(0)->opcode() == IrOpcode::kJSForInPrepare &&
+      ProjectionIndexOf(node->op()) == 2) {
+    return typer_->cache_.kSmi;
+  }
   // TODO(titzer): use the output type of the input to determine the bounds.
   return Type::Any();
 }