Avoid jumping to the runtime for ForInFilter

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 27271fcdb3fb30b716dc2ba32c4f53e9c6021a06..9af6e6e44d6ece3efe070c56447f8ec272c92302 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -1764,9 +1764,13 @@ Reduction JSTypedLowering::ReduceJSForInNext(Node* node) {
   {
     // Filter the {key} to check if it's still a valid property of the
     // {receiver} (does the ToName conversion implicitly).
+    Callable const callable = CodeFactory::ForInFilter(isolate());
+    CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+        isolate(), graph()->zone(), callable.descriptor(), 0,
+        CallDescriptor::kNeedsFrameState);
     vfalse0 = efalse0 = graph()->NewNode(
-        javascript()->CallRuntime(Runtime::kForInFilter), receiver, key,
-        context, frame_state, effect, if_false0);
+        common()->Call(desc), jsgraph()->HeapConstant(callable.code()), key,
+        receiver, context, frame_state, effect, if_false0);
     if_false0 = graph()->NewNode(common()->IfSuccess(), vfalse0);
   }