[turbofan] Add FrameStates before all property accesses.

src/compiler/js-type-feedback.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-type-feedback.h"
 
 #include "src/property-details.h"
 
 #include "src/accessors.h"
 #include "src/ast.h"
@@ skipping 43 matching lines @@
     case IrOpcode::kJSLoadNamed:
       return ReduceJSLoadNamed(node);
     case IrOpcode::kJSStoreNamed:
       return ReduceJSStoreNamed(node);
     case IrOpcode::kJSStoreProperty: {
       HeapObjectMatcher<Name> match(node->InputAt(1));
       if (match.HasValue() && match.Value().handle()->IsName()) {
         // StoreProperty(o, "constant", v) => StoreNamed["constant"](o, v).
         Unique<Name> name = match.Value();
         LanguageMode language_mode = OpParameter<LanguageMode>(node);
-        // StoreProperty has 2 frame state inputs, but StoreNamed only 1.
-        DCHECK_EQ(2, OperatorProperties::GetFrameStateInputCount(node->op()));
-        node->RemoveInput(NodeProperties::FirstFrameStateIndex(node) + 1);
         node->set_op(
             jsgraph()->javascript()->StoreNamed(language_mode, name, KEYED));
         node->RemoveInput(1);
         return ReduceJSStoreNamed(node);
       }
       return ReduceJSStoreProperty(node);
     }
     default:
       break;
   }
@@ skipping 301 matching lines @@
       BailoutId id = OpParameter<FrameStateCallInfo>(node).bailout_id();
       if (id != BailoutId::None()) return frame_state;
     }
   }
   return nullptr;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8