Fix deoptmization of inlined TF InstanceOf to call ToBoolean

src/compiler/frame-states.cc

Index: src/compiler/frame-states.cc
diff --git a/src/compiler/frame-states.cc b/src/compiler/frame-states.cc
index c5fab683d9d84736abc21ca2d2fe00a733b8b8d9..4687cd6d236d1410d9ba499ed1f291865d2cb5b8 100644
--- a/src/compiler/frame-states.cc
+++ b/src/compiler/frame-states.cc
@@ -113,11 +113,11 @@ Node* CreateBuiltinContinuationFrameStateCommon(
   FrameStateType frame_type =
       function.is_null() ? FrameStateType::kBuiltinContinuation
                          : FrameStateType::kJavaScriptBuiltinContinuation;
-  Handle<SharedFunctionInfo> shared(
-      Handle<SharedFunctionInfo>(function->shared()));
   const FrameStateFunctionInfo* state_info =
-      common->CreateFrameStateFunctionInfo(frame_type, parameter_count, 0,
-                                           shared);
+      common->CreateFrameStateFunctionInfo(
+          frame_type, parameter_count, 0,
+          function.is_null() ? Handle<SharedFunctionInfo>()
+                             : Handle<SharedFunctionInfo>(function->shared()));
   const Operator* op = common->FrameState(
       bailout_id, OutputFrameStateCombine::Ignore(), state_info);
 
@@ -143,8 +143,12 @@ Node* CreateStubBuiltinContinuationFrameState(JSGraph* js_graph,
   CallInterfaceDescriptor descriptor = callable.descriptor();
 
   std::vector<Node*> actual_parameters;
-  // Stack parameters first
-  for (int i = 0; i < descriptor.GetStackParameterCount(); ++i) {
+  // Stack parameters first. If the deoptimization is LAZY, the final parameter
+  // is added by the deoptimizer and isn't explicitly passed in the frame state.
+  int stack_parameter_count =
+      descriptor.GetRegisterParameterCount() -
+      (mode == ContinuationFrameStateMode::LAZY ? 1 : 0);
+  for (int i = 0; i < stack_parameter_count; ++i) {
     actual_parameters.push_back(
         parameters[descriptor.GetRegisterParameterCount() + i]);
   }