[turbofan] Correctify FrameState before operations in JSTypeFeedbackSpecializer.

[turbofan] Correctify FrameState before operations in JSTypeFeedbackSpecializer.

Handle missing or improper FrameStates more gracefully.
Uses the operator properties to determine if the node contains a FrameState
before, then checks if a valid bailout id exists.

R=jarin@chromium.org
BUG=

Committed: https://crrev.com/7f2636e0677193e916dca36a45f6ad6eb5e47efa
Cr-Commit-Position: refs/heads/master@{#28364}

[Jarin, 2015-05-12 12:22:12]

lgtm, even though it might be a bit brittle to assume that if there are two
frame states then one must be before and one after. Maybe we want to at least
DCHECK in GetFrameStateBefore that there are not more than two frame states.

[titzer, 2015-05-12 12:29:55]

On 2015/05/12 12:22:12, jarin wrote:
> lgtm, even though it might be a bit brittle to assume that if there are two
> frame states then one must be before and one after. Maybe we want to at least
> DCHECK in GetFrameStateBefore that there are not more than two frame states.

Done.

[titzer, 2015-05-12 12:55:29]

The CQ bit was checked by titzer@chromium.org

[titzer, 2015-05-12 12:55:29]

The patchset sent to the CQ was uploaded after l-g-t-m from jarin@chromium.org
Link to the patchset: https://codereview.chromium.org/1135243002/#ps20001
(title: " ")

[commit-bot: I haz the power, 2015-05-12 12:55:47]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1135243002/20001

[commit-bot: I haz the power, 2015-05-12 12:57:38]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-05-12 12:57:53]

Patchset 2 (id:??) landed as
https://crrev.com/7f2636e0677193e916dca36a45f6ad6eb5e47efa
Cr-Commit-Position: refs/heads/master@{#28364}