[turbofan] Eager frame state gone from JSCallFunction.

test/unittests/compiler/js-builtin-reducer-unittest.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/typer.h"
 #include "src/isolate-inl.h"
@@ skipping 198 matching lines @@
   Node* function = StringFunction("fromCharCode");
 
   Node* effect = graph()->start();
   Node* control = graph()->start();
   Node* context = UndefinedConstant();
   Node* frame_state = graph()->start();
   TRACED_FOREACH(Type*, t0, kNumberTypes) {
     Node* p0 = Parameter(t0, 0);
     Node* call = graph()->NewNode(javascript()->CallFunction(3), function,
                                   UndefinedConstant(), p0, context, frame_state,
-                                  frame_state, effect, control);
+                                  effect, control);
     Reduction r = Reduce(call);
 
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsStringFromCharCode(p0));
   }
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8