[turbofan] fixed escape analysis bug: missing copy of virtual state

src/compiler/escape-analysis.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/escape-analysis.h"
 
 #include <limits>
 
 #include "src/base/flags.h"
 #include "src/bootstrapper.h"
@@ skipping 1065 matching lines @@
     case IrOpcode::kEffectPhi:
       return ProcessEffectPhi(node);
       break;
     default:
       if (node->op()->EffectInputCount() > 0) {
         ForwardVirtualState(node);
       }
       ProcessAllocationUsers(node);
       break;
   }
+  if (OperatorProperties::HasFrameStateInput(node->op())) {
+    virtual_states_[node->id()]->SetCopyRequired();
+  }
   return true;
 }
 
 void EscapeAnalysis::ProcessAllocationUsers(Node* node) {
   for (Edge edge : node->input_edges()) {
     Node* input = edge.to();
     Node* use = edge.from();
     if (edge.index() >= use->op()->ValueInputCount() +
                             OperatorProperties::GetContextInputCount(use->op()))
       continue;
@@ skipping 73 matching lines @@
   DCHECK_NOT_NULL(virtual_states_[effect->id()]);
   if (virtual_states_[node->id()]) {
     virtual_states_[node->id()]->UpdateFrom(virtual_states_[effect->id()],
                                             zone());
   } else {
     virtual_states_[node->id()] = virtual_states_[effect->id()];
     TRACE("Forwarding object state %p from %s#%d to %s#%d",
           static_cast<void*>(virtual_states_[effect->id()]),
           effect->op()->mnemonic(), effect->id(), node->op()->mnemonic(),
           node->id());
-    if (status_analysis_->IsEffectBranchPoint(effect) ||
-        OperatorProperties::HasFrameStateInput(node->op())) {
+    if (status_analysis_->IsEffectBranchPoint(effect)) {
       virtual_states_[node->id()]->SetCopyRequired();
       TRACE(", effect input %s#%d is branch point", effect->op()->mnemonic(),
             effect->id());
     }
     TRACE("\n");
   }
 }
 
 void EscapeAnalysis::ProcessStart(Node* node) {
   DCHECK_EQ(node->opcode(), IrOpcode::kStart);
@@ skipping 494 matching lines @@
     }
   }
   return false;
 }
 
 Graph* EscapeAnalysis::graph() const { return status_analysis_->graph(); }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8