[turbofan] Carefully update frame states during inlining.

src/compiler/js-inlining.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-inlining.h"
 
 #include "src/ast.h"
 #include "src/ast-numbering.h"
 #include "src/compiler/all-nodes.h"
 #include "src/compiler/ast-graph-builder.h"
@@ skipping 333 matching lines @@
   if (call.formal_arguments() != inlinee.formal_parameters()) {
     // In strong mode, in case of too few arguments we need to throw a
     // TypeError so we must not inline this call.
     if (is_strong(info.language_mode()) &&
         call.formal_arguments() < inlinee.formal_parameters()) {
       return NoChange();
     }
     outer_frame_state = CreateArgumentsAdaptorFrameState(&call, info.zone());
   }
 
-  for (Node* node : visitor.copies()) {
-    if (node && node->opcode() == IrOpcode::kFrameState) {
+  // Fix up all outer frame states from the inlinee.
+  for (Node* const node : visitor.copies()) {
+    if (node->opcode() == IrOpcode::kFrameState) {
       DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
-      NodeProperties::ReplaceFrameStateInput(node, 0, outer_frame_state);
+      // Don't touch this frame state, if it already has an "outer frame state".
+      if (NodeProperties::GetFrameStateInput(node, 0)->opcode() !=
+          IrOpcode::kFrameState) {
+        NodeProperties::ReplaceFrameStateInput(node, 0, outer_frame_state);
+      }
     }
   }
 
   return InlineCall(node, inlinee);
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8