[turbofan] Properly handle IfException projections on JSForInNext.

[turbofan] Properly handle IfException projections on JSForInNext.

Don't ignore IfException (and IfSuccess) projections on JSForInNext
nodes during JSTypedLowering::ReduceJSForInNext, but instead rewrire
the IfException projection to the ForInFilter stub call, which can
throw exceptions in case of proxies.

R=yangguo@chromium.org
BUG=v8:6121
Review-Url: https://codereview.chromium.org/2761703002
Cr-Commit-Position: refs/heads/master@{#43925}
Committed: https://chromium.googlesource.com/v8/v8/+/a93e5221d8f1187d3401e0afa232089736200dbe

[Benedikt Meurer, 2017-03-20 06:04:24]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-20 06:04:25]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2017-03-20 06:04:52]

Hey Yang,

Here's a simple monday morning for..in fix.
Please take a look.

Thanks,
Benedikt

[Yang, 2017-03-20 06:14:19]

On 2017/03/20 06:04:52, Benedikt Meurer wrote:
> Hey Yang,
> 
> Here's a simple monday morning for..in fix.
> Please take a look.
> 
> Thanks,
> Benedikt

lgtm.

[Benedikt Meurer, 2017-03-20 06:19:20]

The CQ bit was unchecked by bmeurer@chromium.org

[Benedikt Meurer, 2017-03-20 06:19:26]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2017-03-20 06:19:32]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-20 06:32:29]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1489990766538530, "parent_rev":
"a2588a5ada1fa29c8be4ddf309e0759a36d7fa4b", "commit_rev":
"a93e5221d8f1187d3401e0afa232089736200dbe"}

[commit-bot: I haz the power, 2017-03-20 06:32:37]

Description was changed from

==========
[turbofan] Properly handle IfException projections on JSForInNext.

Don't ignore IfException (and IfSuccess) projections on JSForInNext
nodes during JSTypedLowering::ReduceJSForInNext, but instead rewrire
the IfException projection to the ForInFilter stub call, which can
throw exceptions in case of proxies.

R=yangguo@chromium.org
BUG=v8:6121
==========

to

==========
[turbofan] Properly handle IfException projections on JSForInNext.

Don't ignore IfException (and IfSuccess) projections on JSForInNext
nodes during JSTypedLowering::ReduceJSForInNext, but instead rewrire
the IfException projection to the ForInFilter stub call, which can
throw exceptions in case of proxies.

R=yangguo@chromium.org
BUG=v8:6121

Review-Url: https://codereview.chromium.org/2761703002
Cr-Commit-Position: refs/heads/master@{#43925}
Committed:
https://chromium.googlesource.com/v8/v8/+/a93e5221d8f1187d3401e0afa2320897362...
==========

[commit-bot: I haz the power, 2017-03-20 06:32:38]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/v8/v8/+/a93e5221d8f1187d3401e0afa2320897362...

[RE66, 2017-03-20 13:16:59]

On 2017/03/20 06:32:38, commit-bot: I haz the power wrote:
> Committed patchset #1 (id:1) as
>
https://chromium.googlesource.com/v8/v8/+/a93e5221d8f1187d3401e0afa2320897362...

the "if_false0" is not used

[Benedikt Meurer, 2017-03-20 13:19:19]

On 2017/03/20 13:16:59, RE66 wrote:
> On 2017/03/20 06:32:38, commit-bot: I haz the power wrote:
> > Committed patchset #1 (id:1) as
> >
>
https://chromium.googlesource.com/v8/v8/+/a93e5221d8f1187d3401e0afa2320897362...
> 
> the "if_false0" is not used

It's being used for the Merge.