[turbofan] Fix various bailout points for AstGraphBuilder.

test/mjsunit/compiler/accessor-exceptions2.js

Index: test/mjsunit/compiler/accessor-exceptions2.js
diff --git a/test/mjsunit/regress/regress-crbug-629823.js b/test/mjsunit/compiler/accessor-exceptions2.js
similarity index 54%
copy from test/mjsunit/regress/regress-crbug-629823.js
copy to test/mjsunit/compiler/accessor-exceptions2.js
index bbf74b80afd2fa52b020a03b19553c6d257d43ff..e3acb71a7e1530e06caed7061b4a2f6f66900b44 100644
--- a/test/mjsunit/regress/regress-crbug-629823.js
+++ b/test/mjsunit/compiler/accessor-exceptions2.js
@@ -5,13 +5,16 @@
 // Flags: --allow-natives-syntax
 
 var o = {}
-function bar() {
-  o[0] = +o[0];
-  o = /\u23a1|__v_4/;
+Object.defineProperty(o, "x", {
+  set: function(v) { throw v; }
+});
+
+function foo(o) {
+  try { o.x = 2; } catch (e) { }

[Jarin, 2016/08/01 05:55:26]

Could you check the exception here, please?

[Benedikt Meurer, 2016/08/01 05:55:57]

Done.

+  return 1;
 }
-bar();
-bar();
-bar();
-function foo() { bar(); }
+
+assertEquals(1, foo(o));
+assertEquals(1, foo(o));
 %OptimizeFunctionOnNextCall(foo);
-foo();
+assertEquals(1, foo(o));