[turbofan] Fix missing bailout point before calls.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 1569 matching lines @@
       }
 
       // Grab the context from the {function}.
       Node* context =
           jsgraph()->Constant(handle(function->context(), isolate()));
       NodeProperties::ReplaceContextInput(node, context);
       CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
       if (p.AllowTailCalls()) {
         flags |= CallDescriptor::kSupportsTailCalls;
       }
+      NodeProperties::RemoveFrameStateInput(node, 1);
       NodeProperties::ChangeOp(node,
                                common()->Call(Linkage::GetJSCallDescriptor(
                                    graph()->zone(), false, 1 + arity, flags)));
       return Changed(node);
     }
   }
 
   return NoChange();
 }
 
@@ skipping 495 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8