[deoptimizer] Fix deoptimization in {TranslatedState}.

src/runtime/runtime-scopes.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include <memory>
 
 #include "src/accessors.h"
 #include "src/arguments.h"
@@ skipping 359 matching lines @@
 
     // Skip the receiver.
     iter++;
     argument_count--;
 
     *total_argc = argument_count;
     std::unique_ptr<Handle<Object>[]> param_data(
         NewArray<Handle<Object>>(*total_argc));
     bool should_deoptimize = false;
     for (int i = 0; i < argument_count; i++) {
+      // If we materialize any object, we should deoptimize the frame because we
+      // might alias an object that was eliminated by escape analysis.
       should_deoptimize = should_deoptimize || iter->IsMaterializedObject();
       Handle<Object> value = iter->GetValue();
       param_data[i] = value;
       iter++;
     }
 
     if (should_deoptimize) {
-      translated_values.StoreMaterializedValuesAndDeopt();
+      translated_values.StoreMaterializedValuesAndDeopt(frame);
     }
 
     return param_data;
   } else {
     it.AdvanceToArgumentsFrame();
     frame = it.frame();
     int args_count = frame->ComputeParametersCount();
 
     *total_argc = args_count;
     std::unique_ptr<Handle<Object>[]> param_data(
@@ skipping 559 matching lines @@
 RUNTIME_FUNCTION(Runtime_StoreLookupSlot_Strict) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
   RETURN_RESULT_OR_FAILURE(isolate, StoreLookupSlot(name, value, STRICT));
 }
 
 }  // namespace internal
 }  // namespace v8