[turbofan] Fix deopt point for [[ToObject]] lazy bailout.

src/full-codegen/full-codegen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/full-codegen/full-codegen.h"
 
 #include "src/ast/ast-numbering.h"
 #include "src/ast/ast.h"
 #include "src/ast/prettyprinter.h"
 #include "src/ast/scopeinfo.h"
@@ skipping 1075 matching lines @@
 
 
 void FullCodeGenerator::VisitWithStatement(WithStatement* stmt) {
   Comment cmnt(masm_, "[ WithStatement");
   SetStatementPosition(stmt);
 
   VisitForAccumulatorValue(stmt->expression());
   Callable callable = CodeFactory::ToObject(isolate());
   __ Move(callable.descriptor().GetRegisterParameter(0), result_register());
   __ Call(callable.code(), RelocInfo::CODE_TARGET);
-  PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::NO_REGISTERS);
+  PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   PushOperand(result_register());
   PushFunctionArgumentForContextAllocation();
   CallRuntimeWithOperands(Runtime::kPushWithContext);
   StoreToFrameField(StandardFrameConstants::kContextOffset, context_register());
   PrepareForBailoutForId(stmt->EntryId(), BailoutState::NO_REGISTERS);
 
   Scope* saved_scope = scope();
   scope_ = stmt->scope();
   { WithOrCatch body(this);
     Visit(stmt->statement());
@@ skipping 854 matching lines @@
   return var->scope()->is_nonlinear() ||
          var->initializer_position() >= proxy->position();
 }
 
 
 #undef __
 
 
 }  // namespace internal
 }  // namespace v8