Bug 136187

+++ This bug was initially created as a clone of Bug #136165 +++ This bug is to track the for-in-base-reassigned-later-and-change-structure.js failures and Bug #136165 will be used to track the ASSERT failures. The following JavaScriptCore regression tests are failing after r172794 <http://trac.webkit.org/changeset/172794>: stress/for-in-base-reassigned-later-and-change-structure.js.always-trigger-copy-phase stress/for-in-base-reassigned-later-and-change-structure.js.default stress/for-in-base-reassigned-later-and-change-structure.js.default-ftl stress/for-in-base-reassigned-later-and-change-structure.js.dfg-eager stress/for-in-base-reassigned-later-and-change-structure.js.dfg-eager-no-cjit-validate stress/for-in-base-reassigned-later-and-change-structure.js.ftl-eager stress/for-in-base-reassigned-later-and-change-structure.js.ftl-eager-no-cjit stress/for-in-base-reassigned-later-and-change-structure.js.ftl-no-cjit-no-inline-validate stress/for-in-base-reassigned-later-and-change-structure.js.ftl-no-cjit-validate stress/for-in-base-reassigned-later-and-change-structure.js.no-cjit-validate-phases stress/for-in-base-reassigned-later-and-change-structure.js.no-llint All of these "for-in-base-reassigned-later-and-change-structure.js" fail with "Exception: Error: bad result: NaN"