[turbofan] Carefully update frame states during inlining.

src/compiler/js-inlining.cc

Index: src/compiler/js-inlining.cc
diff --git a/src/compiler/js-inlining.cc b/src/compiler/js-inlining.cc
index 66d71a6e298daf623d612a0f511f6881bb90baec..90c6eecb2e94688016ddeca3e213a4ff50b5b18d 100644
--- a/src/compiler/js-inlining.cc
+++ b/src/compiler/js-inlining.cc
@@ -351,10 +351,15 @@ Reduction JSInliner::Reduce(Node* node) {
     outer_frame_state = CreateArgumentsAdaptorFrameState(&call, info.zone());
   }
 
-  for (Node* node : visitor.copies()) {
-    if (node && node->opcode() == IrOpcode::kFrameState) {
+  // Fix up all outer frame states from the inlinee.
+  for (Node* const node : visitor.copies()) {
+    if (node->opcode() == IrOpcode::kFrameState) {
       DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
-      NodeProperties::ReplaceFrameStateInput(node, 0, outer_frame_state);
+      // Don't touch this frame state, if it already has an "outer frame state".
+      if (NodeProperties::GetFrameStateInput(node, 0)->opcode() !=
+          IrOpcode::kFrameState) {
+        NodeProperties::ReplaceFrameStateInput(node, 0, outer_frame_state);
+      }
     }
   }