Initial shot at deoptimizing JSCallFunction in Turbofan.

src/compiler/ast-graph-builder.cc

Index: src/compiler/ast-graph-builder.cc
diff --git a/src/compiler/ast-graph-builder.cc b/src/compiler/ast-graph-builder.cc
index ac5070869f41eee26104ef4d15452e4846432d42..4f469e2d2ee3cc1f17edbb058539094360d1eb4a 100644
--- a/src/compiler/ast-graph-builder.cc
+++ b/src/compiler/ast-graph-builder.cc
@@ -732,8 +732,13 @@ void AstGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
           environment()->Push(value);
           // result is either the string key or Smi(0) indicating the property
           // is gone.
+          // TODO(jarin) Insert lazy deoptimization support here - the call
+          // actually
+          // can deoptimize.
           Node* res = ProcessArguments(
-              javascript()->Call(3, NO_CALL_FUNCTION_FLAGS), 3);
+              javascript()->Call(3, NO_CALL_FUNCTION_FLAGS,
+                                 CallDescriptor::kCannotDeoptimize),
+              3);
           Node* property_missing = NewNode(javascript()->StrictEqual(), res,
                                            jsgraph()->ZeroConstant());
           {
@@ -1256,9 +1261,12 @@ void AstGraphBuilder::VisitCall(Call* expr) {
   }
 
   // Create node to perform the function call.
-  Operator* call = javascript()->Call(args->length() + 2, flags);
+  Operator* call = javascript()->Call(args->length() + 2, flags,
+                                      CallDescriptor::kCanDeoptimize);
   Node* value = ProcessArguments(call, args->length() + 2);
   ast_context()->ProduceValue(value);
+
+  BuildLazyBailout(value, expr->id());
 }
 
 
@@ -1293,9 +1301,12 @@ void AstGraphBuilder::VisitCallJSRuntime(CallRuntime* expr) {
   VisitForValues(args);
 
   // Create node to perform the JS runtime call.
-  Operator* call = javascript()->Call(args->length() + 2, flags);
+  Operator* call = javascript()->Call(args->length() + 2, flags,
+                                      CallDescriptor::kCanDeoptimize);
   Node* value = ProcessArguments(call, args->length() + 2);
   ast_context()->ProduceValue(value);
+
+  BuildLazyBailout(value, expr->id());
 }