[turbofan] Fix various bailout points for AstGraphBuilder.

test/mjsunit/compiler/accessor-exceptions1.js

Index: test/mjsunit/compiler/accessor-exceptions1.js
diff --git a/test/mjsunit/regress/regress-crbug-629823.js b/test/mjsunit/compiler/accessor-exceptions1.js
similarity index 52%
copy from test/mjsunit/regress/regress-crbug-629823.js
copy to test/mjsunit/compiler/accessor-exceptions1.js
index bbf74b80afd2fa52b020a03b19553c6d257d43ff..716d229abab8ec8a7bca620d724e1382f1ba9eb5 100644
--- a/test/mjsunit/regress/regress-crbug-629823.js
+++ b/test/mjsunit/compiler/accessor-exceptions1.js
@@ -5,13 +5,17 @@
 // Flags: --allow-natives-syntax
 
 var o = {}
-function bar() {
-  o[0] = +o[0];
-  o = /\u23a1|__v_4/;
+Object.defineProperty(o, "x", {
+  get: function() { throw 7; }
+});
+
+function foo(o) {
+  var x = 1;
+  try { o.x; } catch (e) { x = e; }
+  return x;
 }
-bar();
-bar();
-bar();
-function foo() { bar(); }
+
+assertEquals(7, foo(o));
+assertEquals(7, foo(o));
 %OptimizeFunctionOnNextCall(foo);
-foo();
+assertEquals(7, foo(o));