[turbofan] Fix loop assignment analysis on ForInStatements.

test/mjsunit/regress/regress-crbug-647887.js

Index: test/mjsunit/regress/regress-crbug-647887.js
diff --git a/test/mjsunit/compiler/regress-math-sign-nan-type.js b/test/mjsunit/regress/regress-crbug-647887.js
similarity index 68%
copy from test/mjsunit/compiler/regress-math-sign-nan-type.js
copy to test/mjsunit/regress/regress-crbug-647887.js
index e16eba8c5a3b8ca48f8a055579f6f42289f40a41..84e598d5aa99eed39494d387d4784616c8defbf5 100644
--- a/test/mjsunit/compiler/regress-math-sign-nan-type.js
+++ b/test/mjsunit/regress/regress-crbug-647887.js
@@ -4,11 +4,11 @@
 
 // Flags: --allow-natives-syntax
 
-function f(a) {
-  return Math.sign(+a) < 2;
+function f(obj) {
+  var key;
+  for (key in obj) { }
+  return key === undefined;
 }
 
-f(NaN);
-f(NaN);
 %OptimizeFunctionOnNextCall(f);
-assertFalse(f(NaN));
+assertFalse(f({ foo:0 }));