Fix deoptmization of inlined TF InstanceOf to call ToBoolean

src/compiler/frame-states.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/frame-states.h"
 
 #include "src/base/functional.h"
 #include "src/callable.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/js-graph.h"
@@ skipping 95 matching lines @@
   BailoutId bailout_id = Builtins::GetContinuationBailoutId(name);
   Callable callable = Builtins::CallableFor(isolate, name);
 
   const Operator* op_param =
       common->StateValues(parameter_count, SparseInputMask::Dense());
   Node* params_node = graph->NewNode(op_param, parameter_count, parameters);
 
   FrameStateType frame_type =
       function.is_null() ? FrameStateType::kBuiltinContinuation
                          : FrameStateType::kJavaScriptBuiltinContinuation;
-  Handle<SharedFunctionInfo> shared(
-      Handle<SharedFunctionInfo>(function->shared()));
   const FrameStateFunctionInfo* state_info =
-      common->CreateFrameStateFunctionInfo(frame_type, parameter_count, 0,
-                                           shared);
+      common->CreateFrameStateFunctionInfo(
+          frame_type, parameter_count, 0,
+          function.is_null() ? Handle<SharedFunctionInfo>()
+                             : Handle<SharedFunctionInfo>(function->shared()));
   const Operator* op = common->FrameState(
       bailout_id, OutputFrameStateCombine::Ignore(), state_info);
 
   Node* function_node = function.is_null() ? js_graph->UndefinedConstant()
                                            : js_graph->HeapConstant(function);
 
   Node* frame_state = graph->NewNode(
       op, params_node, js_graph->EmptyStateValues(),
       js_graph->EmptyStateValues(), context, function_node, outer_frame_state);
 
   return frame_state;
 }
 }  // namespace
 
 Node* CreateStubBuiltinContinuationFrameState(JSGraph* js_graph,
                                               Builtins::Name name,
                                               Node* context, Node** parameters,
                                               int parameter_count,
                                               Node* outer_frame_state,
                                               ContinuationFrameStateMode mode) {
   Isolate* isolate = js_graph->isolate();
   Callable callable = Builtins::CallableFor(isolate, name);
   CallInterfaceDescriptor descriptor = callable.descriptor();
 
   std::vector<Node*> actual_parameters;
-  // Stack parameters first
-  for (int i = 0; i < descriptor.GetStackParameterCount(); ++i) {
+  // Stack parameters first. If the deoptimization is LAZY, the final parameter
+  // is added by the deoptimizer and isn't explicitly passed in the frame state.
+  int stack_parameter_count =
+      descriptor.GetRegisterParameterCount() -
+      (mode == ContinuationFrameStateMode::LAZY ? 1 : 0);
+  for (int i = 0; i < stack_parameter_count; ++i) {
     actual_parameters.push_back(
         parameters[descriptor.GetRegisterParameterCount() + i]);
   }
   // Register parameters follow, context will be added by instruction selector
   // during FrameState translation.
   for (int i = 0; i < descriptor.GetRegisterParameterCount(); ++i) {
     actual_parameters.push_back(parameters[i]);
   }
 
   return CreateBuiltinContinuationFrameStateCommon(
-      js_graph, name, context, &actual_parameters[0],
+      js_graph, name, context, actual_parameters.data(),
       static_cast<int>(actual_parameters.size()), outer_frame_state,
       Handle<JSFunction>());
 }
 
 Node* CreateJavaScriptBuiltinContinuationFrameState(
     JSGraph* js_graph, Handle<JSFunction> function, Builtins::Name name,
     Node* target, Node* context, Node** stack_parameters,
     int stack_parameter_count, Node* outer_frame_state,
     ContinuationFrameStateMode mode) {
   Isolate* isolate = js_graph->isolate();
@@ skipping 28 matching lines @@
   actual_parameters.push_back(argc);
 
   return CreateBuiltinContinuationFrameStateCommon(
       js_graph, name, context, &actual_parameters[0],
       static_cast<int>(actual_parameters.size()), outer_frame_state, function);
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8