[turbofan] Fix ForInStatement that deopts during filter.

src/compiler/ast-graph-builder.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/ast-graph-builder.h"
 
 #include "src/compiler.h"
 #include "src/compiler/ast-loop-assignment-analyzer.h"
 #include "src/compiler/control-builders.h"
 #include "src/compiler/js-type-feedback.h"
@@ skipping 1252 matching lines @@
     test_should_filter.Then();
     value = environment()->Pop();
     Node* builtins = BuildLoadBuiltinsObject();
     Node* function = BuildLoadObjectField(
         builtins,
         JSBuiltinsObject::OffsetOfFunctionWithId(Builtins::FILTER_KEY));
     // result is either the string key or Smi(0) indicating the property
     // is gone.
     Node* res = NewNode(javascript()->CallFunction(3, NO_CALL_FUNCTION_FLAGS),
                         function, obj, value);
-    // TODO(jarin): provide real bailout id.
-    PrepareFrameState(res, BailoutId::None());
+    PrepareFrameState(res, stmt->FilterId(), OutputFrameStateCombine::Push());
     Node* property_missing =
         NewNode(javascript()->StrictEqual(), res, jsgraph()->ZeroConstant());
     {
       IfBuilder is_property_missing(this);
       is_property_missing.If(property_missing);
       is_property_missing.Then();
       // Inc counter and continue.
       Node* index_inc =
           NewNode(javascript()->Add(), index, jsgraph()->OneConstant());
       // TODO(jarin): provide real bailout id.
@@ skipping 2266 matching lines @@
     // Phi does not exist yet, introduce one.
     value = NewPhi(inputs, value, control);
     value->ReplaceInput(inputs - 1, other);
   }
   return value;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8