[Interpreter] Generate valid FrameStates in the Bytecode Graph Builder.

src/compiler/js-typed-lowering.h

Index: src/compiler/js-typed-lowering.h
diff --git a/src/compiler/js-typed-lowering.h b/src/compiler/js-typed-lowering.h
index 6dccf1773e3e41cc0e872dc3042ae8493e02e1d9..7e1819313881ab50909b8072c32cbb39c3a3ed72 100644
--- a/src/compiler/js-typed-lowering.h
+++ b/src/compiler/js-typed-lowering.h
@@ -35,6 +35,7 @@ class JSTypedLowering final : public AdvancedReducer {
   enum Flag {
     kNoFlags = 0u,
     kDeoptimizationEnabled = 1u << 0,
+    kDisableBinaryOpReduction = 1u << 1,

[Jarin, 2015/12/13 20:26:30]

Again, I do not think we really need to disable binop reduction to make lazy
deoptimization from %DeoptimizeFunction(..) working.  

[rmcilroy, 2015/12/16 15:40:57]

As discussed, this is for eager deopt. Unfortunately if we add any non-empty
frame-state to binary ops then the js-typed-lowering optimizations will crash
due to the "stack values" (i.e., accumulator) only having 1 value instead of the
multiple expected by the optimizations. Happy to chat offline about a plan for
enabling them for the interpreter. 

[Jarin, 2015/12/17 09:44:05]

Acknowledged. 

We could make this hack work in the interpreter if we annotated all the JS
operations with the positions of the inputs in the environment, so that we knew
where to poke the converted inputs, but I suspect there would be some resistance
from Michi. 

Once we fully support type feedback and asm.js pipeline takes a different path,
this hack can hopefully go away (we would just deopt if the input is not number
and we had number feedback; if we would not have number feedback, we would just
use generic lowering). 

[rmcilroy, 2015/12/17 14:43:48]

Yes, this was the general approach I was thinking about to solve this.
This would probably be even better :).

   };
   typedef base::Flags<Flag> Flags;