[turbofan] Fix various bailout points for AstGraphBuilder.

test/mjsunit/compiler/accessor-exceptions1.js

Index: test/mjsunit/compiler/accessor-exceptions1.js
diff --git a/test/mjsunit/regress/regress-crbug-629823.js b/test/mjsunit/compiler/accessor-exceptions1.js
similarity index 55%
copy from test/mjsunit/regress/regress-crbug-629823.js
copy to test/mjsunit/compiler/accessor-exceptions1.js
index bbf74b80afd2fa52b020a03b19553c6d257d43ff..7f50df3a5785d0148236ed94af317f14bc094206 100644
--- a/test/mjsunit/regress/regress-crbug-629823.js
+++ b/test/mjsunit/compiler/accessor-exceptions1.js
@@ -5,13 +5,16 @@
 // Flags: --allow-natives-syntax
 
 var o = {}
-function bar() {
-  o[0] = +o[0];
-  o = /\u23a1|__v_4/;
+Object.defineProperty(o, "x", {
+  get: function() { throw o; }
+});
+
+function foo(o) {
+  try { o.x; } catch (e) { }

[Jarin, 2016/08/01 05:55:26]

Could you also check that we catch the right exception?

[Benedikt Meurer, 2016/08/01 05:55:57]

Done.

+  return 1;
 }
-bar();
-bar();
-bar();
-function foo() { bar(); }
+
+assertEquals(1, foo(o));
+assertEquals(1, foo(o));
 %OptimizeFunctionOnNextCall(foo);
-foo();
+assertEquals(1, foo(o));