[turbofan] Remove frame state input from speculative ops.

src/compiler/simplified-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/simplified-lowering.h"
 
 #include <limits>
 
 #include "src/address-map.h"
 #include "src/base/bits.h"
@@ skipping 1015 matching lines @@
         edge.UpdateTo(control);
       } else if (NodeProperties::IsEffectEdge(edge)) {
         edge.UpdateTo(effect);
       } else {
         DCHECK(NodeProperties::IsValueEdge(edge));
       }
     }
   }
 
   void ChangeToInt32OverflowOp(Node* node, const Operator* op) {
-    Node* frame_state = NodeProperties::GetFrameStateInput(node, 0);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
+    Node* frame_state = NodeProperties::FindFrameStateBefore(node);
     Node* arith = graph()->NewNode(op, node->InputAt(0), node->InputAt(1));
     Node* overflow = graph()->NewNode(common()->Projection(1), arith);
     control = effect = graph()->NewNode(common()->DeoptimizeIf(), overflow,
                                         frame_state, effect, control);
 
     Node* value = graph()->NewNode(common()->Projection(0), arith);
     ReplaceEffectControlUses(node, effect, control);
     DeferReplacement(node, value);
   }
 
@@ skipping 1765 matching lines @@
         isolate(), graph()->zone(), callable.descriptor(), 0, flags,
         Operator::kNoProperties);
     to_number_operator_.set(common()->Call(desc));
   }
   return to_number_operator_.get();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8