[turbofan] Pass closure as node to FrameState.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index c3b723026da44cdb916cd3a667b4c41ab487f622..7d8d20043e43711289215b286115fd16f9f30d24 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -289,7 +289,8 @@ class JSBinopReduction final {
 
     return graph()->NewNode(op, frame_state->InputAt(0),
                             frame_state->InputAt(1), frame_state->InputAt(2),
-                            frame_state->InputAt(3), frame_state->InputAt(4));
+                            frame_state->InputAt(3), frame_state->InputAt(4),
+                            frame_state->InputAt(5));
   }
 
   Node* CreateFrameStateForRightInput(Node* frame_state, Node* converted_left) {
@@ -326,7 +327,8 @@ class JSBinopReduction final {
 
     return graph()->NewNode(op, frame_state->InputAt(0),
                             frame_state->InputAt(1), new_stack,
-                            frame_state->InputAt(3), frame_state->InputAt(4));
+                            frame_state->InputAt(3), frame_state->InputAt(4),
+                            frame_state->InputAt(5));
   }
 
   Node* ConvertPlainPrimitiveToNumber(Node* node) {