[turbofan] Add FrameStates before all property accesses.

test/unittests/compiler/js-type-feedback-unittest.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/js-type-feedback.h"
@@ skipping 62 matching lines @@
 
   Node* ReturnLoadNamedFromGlobal(const char* string, Node* effect,
                                   Node* control) {
     VectorSlotPair feedback(Handle<TypeFeedbackVector>::null(),
                             FeedbackVectorICSlot::Invalid());
     Node* global = Parameter(Type::GlobalObject());
     Node* context = UndefinedConstant();
 
     Unique<Name> name = Unique<Name>::CreateUninitialized(
         isolate()->factory()->NewStringFromAsciiChecked(string));
-    Node* load = graph()->NewNode(javascript()->LoadNamed(name, feedback),
-                                  global, context);
+    const Operator* op = javascript()->LoadNamed(name, feedback);
+    Node* load = graph()->NewNode(op, global, context);
     if (FLAG_turbo_deoptimization) {
-      load->AppendInput(zone(), EmptyFrameState());
+      for (int i = 0; i < OperatorProperties::GetFrameStateInputCount(op);
+           i++) {
+        load->AppendInput(zone(), EmptyFrameState());
+      }
     }
     load->AppendInput(zone(), effect);
     load->AppendInput(zone(), control);
     Node* if_success = graph()->NewNode(common()->IfSuccess(), load);
     return graph()->NewNode(common()->Return(), load, load, if_success);
   }
 
   CompilationDependencies* dependencies() { return &dependencies_; }
 
  private:
@@ skipping 171 matching lines @@
       dependencies()->Rollback();
     } else {
       ASSERT_FALSE(r.Changed());
       EXPECT_TRUE(dependencies()->IsEmpty());
     }
   }
 }
 }
 }
 }