[Interpreter] Generate valid FrameStates in the Bytecode Graph Builder.

src/compiler/pipeline.cc

Index: src/compiler/pipeline.cc
diff --git a/src/compiler/pipeline.cc b/src/compiler/pipeline.cc
index fd511b30138b0f032ddb6a3525c598ba38d5a318..7047ca9f42d98956c245a00a6289eaf11cf51fe1 100644
--- a/src/compiler/pipeline.cc
+++ b/src/compiler/pipeline.cc
@@ -609,11 +609,16 @@ struct TypedLoweringPhase {
                                               data->common());
     LoadElimination load_elimination(&graph_reducer);
     JSBuiltinReducer builtin_reducer(&graph_reducer, data->jsgraph());
+    JSTypedLowering::Flags typed_lowering_flags = JSTypedLowering::kNoFlags;
+    if (data->info()->is_deoptimization_enabled()) {
+      typed_lowering_flags |= JSTypedLowering::kDeoptimizationEnabled;
+    }
+    if (data->info()->shared_info()->HasBytecodeArray()) {
+      typed_lowering_flags |= JSTypedLowering::kDisableBinaryOpReduction;
+    }
     JSTypedLowering typed_lowering(&graph_reducer, data->info()->dependencies(),
-                                   data->info()->is_deoptimization_enabled()
-                                       ? JSTypedLowering::kDeoptimizationEnabled
-                                       : JSTypedLowering::kNoFlags,
-                                   data->jsgraph(), temp_zone);
+                                   typed_lowering_flags, data->jsgraph(),
+                                   temp_zone);
     JSIntrinsicLowering intrinsic_lowering(
         &graph_reducer, data->jsgraph(),
         data->info()->is_deoptimization_enabled()