[turbofan] Fix missing bailout point before calls.

[turbofan] Fix missing bailout point before calls.

In order to properly (lazy) bailout when converting the receiver for
sloppy mode functions (using the newly added JSConvertReceiver
operator), we need to have a bailout location right before every call
(also right before every %_Call and %_CallFunction), otherwise if the
JSConvertReceiver just reuses the lazy bailout frame state from the
JSCallFunction node, it will skip the whole function in case of lazy
bailout.

Note it should be impossible to trigger this currently because we do not
yet support AllocationSite code dependencies in TurboFan, which can
trigger this kind of lazy bailout; therefore it's not possible to write
a regression test (yet).

R=yangguo@chromium.org
BUG=v8:4493
LOG=n

Committed: https://crrev.com/6040d5c0db96b38bd3008bc4cd644dd1d87aa4db
Cr-Commit-Position: refs/heads/master@{#31668}

[Benedikt Meurer, 2015-10-30 06:18:52]

Hey Yang,

Here's the fix for the funny "skip function invocation" bailout I told you about
offline.
Please take a look.

Thanks,
Benedikt

[Yang, 2015-10-30 06:31:50]

lgtm. Maybe a test case?

[Benedikt Meurer, 2015-10-30 06:41:16]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-10-30 06:41:16]

The patchset sent to the CQ was uploaded after l-g-t-m from yangguo@chromium.org
Link to the patchset: https://codereview.chromium.org/1425883004/#ps20001
(title: "Update unittests.")

[commit-bot: I haz the power, 2015-10-30 06:41:29]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1425883004/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1425883004/20001

[commit-bot: I haz the power, 2015-10-30 06:59:02]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-10-30 06:59:17]

Patchset 2 (id:??) landed as
https://crrev.com/6040d5c0db96b38bd3008bc4cd644dd1d87aa4db
Cr-Commit-Position: refs/heads/master@{#31668}