Fix continue statements within for-in loops.

src/compiler/ast-graph-builder.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/ast-graph-builder.h"
 
 #include "src/compiler.h"
 #include "src/compiler/control-builders.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-properties.h"
@@ skipping 726 matching lines @@
           }
           // Replace 'value' in environment.
           environment()->Push(res);
           test_should_filter.Else();
           test_should_filter.End();
         }
         value = environment()->Pop();
         // Bind value and do loop body.
         VisitForInAssignment(stmt->each(), value);
         VisitIterationBody(stmt, &for_loop, 5);
+        for_loop.EndBody();
         // Inc counter and continue.
         Node* index_inc =
             NewNode(javascript()->Add(), index, jsgraph()->OneConstant());
         // TODO(jarin): provide real bailout id.
         PrepareFrameState(index_inc, BailoutId::None());
         environment()->Poke(0, index_inc);
-        for_loop.EndBody();
         for_loop.EndLoop();
         environment()->Drop(5);
         // PrepareForBailoutForId(stmt->ExitId(), NO_REGISTERS);
       }
       have_no_properties.End();
     }
     is_null.End();
   }
   is_undefined.End();
 }
@@ skipping 1267 matching lines @@
 
     // Continue with the original environment.
     set_environment(continuation_env);
     NewNode(common()->Continuation());
   }
 }
 
 }
 }
 }  // namespace v8::internal::compiler