[turbofan] Fix bugs in escape analysis.

src/compiler/escape-analysis-reducer.h

Index: src/compiler/escape-analysis-reducer.h
diff --git a/src/compiler/escape-analysis-reducer.h b/src/compiler/escape-analysis-reducer.h
index 1c0da165fb61e7f20b8a10bd7d21147273b15244..19470cbefbd621b091557a406596b8a5926350b0 100644
--- a/src/compiler/escape-analysis-reducer.h
+++ b/src/compiler/escape-analysis-reducer.h
@@ -29,6 +29,9 @@ class EscapeAnalysisReducer final : public AdvancedReducer {
                         EscapeAnalysis* escape_analysis, Zone* zone);
 
   Reduction Reduce(Node* node) final;
+  void SetExistsVirtualAllocate(bool exists) {
+    exists_virtual_allocate_ = exists;
+  }
 
  private:
   Reduction ReduceLoad(Node* node);
@@ -38,9 +41,9 @@ class EscapeAnalysisReducer final : public AdvancedReducer {
   Reduction ReduceReferenceEqual(Node* node);
   Reduction ReduceObjectIsSmi(Node* node);
   Reduction ReduceFrameStateUses(Node* node);
-  Node* ReduceFrameState(Node* node, Node* effect, bool multiple_users);
-  Node* ReduceStateValueInputs(Node* node, Node* effect, bool multiple_users);
+  Node* ReduceDeoptState(Node* node, Node* effect, bool multiple_users);
   Node* ReduceStateValueInput(Node* node, int node_index, Node* effect,
+                              bool node_multiused, bool already_cloned,
                               bool multiple_users);
 
   JSGraph* jsgraph() const { return jsgraph_; }
@@ -51,7 +54,10 @@ class EscapeAnalysisReducer final : public AdvancedReducer {
   JSGraph* const jsgraph_;
   EscapeAnalysis* escape_analysis_;
   Zone* const zone_;
+  // _visited marks nodes we already processed (allocs, loads, stores)
+  // and nodes that do not need a visit from ReduceDeoptState etc.
   BitVector visited_;
+  bool exists_virtual_allocate_;
 
   DISALLOW_COPY_AND_ASSIGN(EscapeAnalysisReducer);
 };