[turbofan] Fix --turbo-osr for OSRing into inner loop inside for-in.

test/mjsunit/compiler/osr-forin-nested.js

Index: test/mjsunit/compiler/osr-forin-nested.js
diff --git a/test/mjsunit/compiler/osr-forin-nested.js b/test/mjsunit/compiler/osr-forin-nested.js
new file mode 100644
index 0000000000000000000000000000000000000000..ad55b30bd883a13d148b8572031177fb0fa7ec4e
--- /dev/null
+++ b/test/mjsunit/compiler/osr-forin-nested.js
@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-osr --allow-natives-syntax
+
+function test(e, f, v) {
+  assertEquals(e, f(v));
+  assertEquals(e, f(v));
+  assertEquals(e, f(v));
+}
+
+function foo(t) {
+  for (var x in t) {
+    for (var i = 0; i < 2; i++) {
+      %OptimizeOsr();
+    }
+  }
+  return 5;
+}
+
+test(5, foo, {x:20});
+
+function bar(t) {
+  var sum = 0;
+  for (var x in t) {
+    for (var i = 0; i < 2; i++) {
+      %OptimizeOsr();
+      sum += t[x];
+    }
+  }
+  return sum;
+}
+
+test(62, bar, {x:20,y:11});