[turbofan] Fix bug in object state generation of escape analysis.

src/compiler/escape-analysis-reducer.cc

Index: src/compiler/escape-analysis-reducer.cc
diff --git a/src/compiler/escape-analysis-reducer.cc b/src/compiler/escape-analysis-reducer.cc
index 1e02591bcadf07bc2c662c9aabe2d99b053b2d25..df8b65dab2e336b23bf1a695d37f3d43cac6ef27 100644
--- a/src/compiler/escape-analysis-reducer.cc
+++ b/src/compiler/escape-analysis-reducer.cc
@@ -246,7 +246,14 @@ Node* EscapeAnalysisReducer::ReduceStateValueInputs(Node* node, Node* effect,
   DCHECK_NOT_NULL(effect);
   Node* clone = nullptr;
   for (int i = 0; i < node->op()->ValueInputCount(); ++i) {
-    if (Node* ret = ReduceStateValueInput(node, i, effect, multiple_users)) {
+    Node* input = NodeProperties::GetValueInput(node, i);
+    Node* ret = nullptr;
+    if (input->opcode() == IrOpcode::kStateValues) {
+      ret = ReduceStateValueInputs(input, effect, multiple_users);
+    } else {
+      ret = ReduceStateValueInput(node, i, effect, multiple_users);
+    }
+    if (ret) {
       node = ret;
       DCHECK_NULL(clone);
       clone = ret;