[turbofan] Remove special JSForInStep and JSForInDone.

src/compiler/verifier.cc

Index: src/compiler/verifier.cc
diff --git a/src/compiler/verifier.cc b/src/compiler/verifier.cc
index 386e32ea1caa7e9095285e74abeace09d537d72a..602aa30fd38fe688d4b327dbccb21be2d11c7cdf 100644
--- a/src/compiler/verifier.cc
+++ b/src/compiler/verifier.cc
@@ -635,23 +635,10 @@ void Verifier::Visitor::Check(Node* node) {
       CheckUpperIs(node, Type::Any());
       break;
     }
-    case IrOpcode::kJSForInDone: {
-      // TODO(bmeurer): OSR breaks this invariant, although the node is not user
-      // visible, so we know it is safe (fullcodegen has an unsigned smi there).
-      // CheckValueInputIs(node, 0, Type::UnsignedSmall());
-      break;
-    }
     case IrOpcode::kJSForInNext: {
       CheckUpperIs(node, Type::Union(Type::Name(), Type::Undefined(), zone));
       break;
     }
-    case IrOpcode::kJSForInStep: {
-      // TODO(bmeurer): OSR breaks this invariant, although the node is not user
-      // visible, so we know it is safe (fullcodegen has an unsigned smi there).
-      // CheckValueInputIs(node, 0, Type::UnsignedSmall());
-      CheckUpperIs(node, Type::UnsignedSmall());
-      break;
-    }
 
     case IrOpcode::kJSLoadMessage:
     case IrOpcode::kJSStoreMessage: