Initial support for debugger frame state in Turbofan.

src/compiler/ast-graph-builder.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/ast-graph-builder.h"
 
 #include "src/compiler.h"
 #include "src/compiler/control-builders.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/node-properties-inl.h"
@@ skipping 143 matching lines @@
 
 
 AstGraphBuilder::Environment::Environment(AstGraphBuilder* builder,
                                           Scope* scope,
                                           Node* control_dependency)
     : StructuredGraphBuilder::Environment(builder, control_dependency),
       parameters_count_(scope->num_parameters() + 1),
       locals_count_(scope->num_stack_slots()),
       parameters_node_(NULL),
       locals_node_(NULL),
-      stack_node_(NULL),
-      parameters_dirty_(true),
-      locals_dirty_(true),
-      stack_dirty_(true) {
+      stack_node_(NULL) {
   DCHECK_EQ(scope->num_parameters() + 1, parameters_count());
 
   // Bind the receiver variable.
   Node* receiver = builder->graph()->NewNode(common()->Parameter(0),
                                              builder->graph()->start());
   values()->push_back(receiver);
 
   // Bind all parameter variables. The parameter indices are shifted by 1
   // (receiver is parameter index -1 but environment index 0).
   for (int i = 0; i < scope->num_parameters(); ++i) {
     Node* parameter = builder->graph()->NewNode(common()->Parameter(i + 1),
                                                 builder->graph()->start());
     values()->push_back(parameter);
   }
 
   // Bind all local variables to undefined.
   Node* undefined_constant = builder->jsgraph()->UndefinedConstant();
   values()->insert(values()->end(), locals_count(), undefined_constant);
 }
 
 
 AstGraphBuilder::Environment::Environment(const Environment& copy)
     : StructuredGraphBuilder::Environment(
           static_cast<StructuredGraphBuilder::Environment>(copy)),
       parameters_count_(copy.parameters_count_),
       locals_count_(copy.locals_count_),
       parameters_node_(copy.parameters_node_),
       locals_node_(copy.locals_node_),
-      stack_node_(copy.stack_node_),
-      parameters_dirty_(copy.parameters_dirty_),
-      locals_dirty_(copy.locals_dirty_),
-      stack_dirty_(copy.stack_dirty_) {}
+      stack_node_(copy.stack_node_) {}
+
+
+void AstGraphBuilder::Environment::UpdateStateValues(Node** state_values,
+                                                     int offset, int count) {
+  bool should_update = false;
+  Node** env_values = (count == 0) ? NULL : &values()->at(offset);
+  if (*state_values == NULL || (*state_values)->InputCount() != count) {
+    should_update = true;
+  } else {
+    DCHECK(static_cast<size_t>(offset + count) <= values()->size());
+    for (int i = 0; i < count; i++) {
+      if ((*state_values)->InputAt(i) != env_values[i]) {
+        should_update = true;
+        break;
+      }
+    }
+  }
+  if (should_update) {
+    Operator* op = common()->StateValues(count);
+    (*state_values) = graph()->NewNode(op, count, env_values);
+  }
+}
 
 
 Node* AstGraphBuilder::Environment::Checkpoint(BailoutId ast_id) {
-  if (parameters_dirty_) {
-    Operator* op = common()->StateValues(parameters_count());
-    if (parameters_count() != 0) {
-      Node** parameters = &values()->front();
-      parameters_node_ = graph()->NewNode(op, parameters_count(), parameters);
-    } else {
-      parameters_node_ = graph()->NewNode(op);
-    }
-    parameters_dirty_ = false;
-  }
-  if (locals_dirty_) {
-    Operator* op = common()->StateValues(locals_count());
-    if (locals_count() != 0) {
-      Node** locals = &values()->at(parameters_count_);
-      locals_node_ = graph()->NewNode(op, locals_count(), locals);
-    } else {
-      locals_node_ = graph()->NewNode(op);
-    }
-    locals_dirty_ = false;
-  }
-  if (stack_dirty_) {
-    Operator* op = common()->StateValues(stack_height());
-    if (stack_height() != 0) {
-      Node** stack = &values()->at(parameters_count_ + locals_count_);
-      stack_node_ = graph()->NewNode(op, stack_height(), stack);
-    } else {
-      stack_node_ = graph()->NewNode(op);
-    }
-    stack_dirty_ = false;
-  }
+  UpdateStateValues(&parameters_node_, 0, parameters_count());
+  UpdateStateValues(&locals_node_, parameters_count(), locals_count());
+  UpdateStateValues(&stack_node_, parameters_count() + locals_count(),
+                    stack_height());
 
   Operator* op = common()->FrameState(ast_id);
 
   return graph()->NewNode(op, parameters_node_, locals_node_, stack_node_);
 }
 
 
 AstGraphBuilder::AstContext::AstContext(AstGraphBuilder* own,
-                                        Expression::Context kind,
-                                        BailoutId bailout_id)
-    : bailout_id_(bailout_id),
-      kind_(kind),
-      owner_(own),
-      outer_(own->ast_context()) {
+                                        Expression::Context kind)
+    : kind_(kind), owner_(own), outer_(own->ast_context()) {
   owner()->set_ast_context(this);  // Push.
 #ifdef DEBUG
   original_height_ = environment()->stack_height();
 #endif
 }
 
 
 AstGraphBuilder::AstContext::~AstContext() {
   owner()->set_ast_context(outer_);  // Pop.
 }
 
 
 AstGraphBuilder::AstEffectContext::~AstEffectContext() {
   DCHECK(environment()->stack_height() == original_height_);
 }
 
 
 AstGraphBuilder::AstValueContext::~AstValueContext() {
   DCHECK(environment()->stack_height() == original_height_ + 1);
 }
 
 
 AstGraphBuilder::AstTestContext::~AstTestContext() {
   DCHECK(environment()->stack_height() == original_height_ + 1);
 }
 
 
-void AstGraphBuilder::AstEffectContext::ProduceValueWithLazyBailout(
-    Node* value) {
-  ProduceValue(value);
-  owner()->BuildLazyBailout(value, bailout_id_);
-}
-
-
-void AstGraphBuilder::AstValueContext::ProduceValueWithLazyBailout(
-    Node* value) {
-  ProduceValue(value);
-  owner()->BuildLazyBailout(value, bailout_id_);
-}
-
-
-void AstGraphBuilder::AstTestContext::ProduceValueWithLazyBailout(Node* value) {
-  environment()->Push(value);
-  owner()->BuildLazyBailout(value, bailout_id_);
-  environment()->Pop();
-  ProduceValue(value);
-}
-
-
 void AstGraphBuilder::AstEffectContext::ProduceValue(Node* value) {
   // The value is ignored.
 }
 
 
 void AstGraphBuilder::AstValueContext::ProduceValue(Node* value) {
   environment()->Push(value);
 }
 
 
@@ skipping 46 matching lines @@
 
 
 void AstGraphBuilder::VisitForValues(ZoneList<Expression*>* exprs) {
   for (int i = 0; i < exprs->length(); ++i) {
     VisitForValue(exprs->at(i));
   }
 }
 
 
 void AstGraphBuilder::VisitForValue(Expression* expr) {
-  AstValueContext for_value(this, expr->id());
+  AstValueContext for_value(this);
   if (!HasStackOverflow()) {
     expr->Accept(this);
   }
 }
 
 
 void AstGraphBuilder::VisitForEffect(Expression* expr) {
-  AstEffectContext for_effect(this, expr->id());
+  AstEffectContext for_effect(this);
   if (!HasStackOverflow()) {
     expr->Accept(this);
   }
 }
 
 
 void AstGraphBuilder::VisitForTest(Expression* expr) {
-  AstTestContext for_condition(this, expr->id());
+  AstTestContext for_condition(this);
   if (!HasStackOverflow()) {
     expr->Accept(this);
   }
 }
 
 
 void AstGraphBuilder::VisitVariableDeclaration(VariableDeclaration* decl) {
   Variable* variable = decl->proxy()->var();
   VariableMode mode = decl->mode();
   bool hole_init = mode == CONST || mode == CONST_LEGACY || mode == LET;
@@ skipping 317 matching lines @@
         environment()->Push(cache_length);
         environment()->Push(jsgraph()->ZeroConstant());
         // PrepareForBailoutForId(stmt->BodyId(), NO_REGISTERS);
         LoopBuilder for_loop(this);
         for_loop.BeginLoop();
         // Check loop termination condition.
         Node* index = environment()->Peek(0);
         Node* exit_cond =
             NewNode(javascript()->LessThan(), index, cache_length);
         // TODO(jarin): provide real bailout id.
-        BuildLazyBailout(exit_cond, BailoutId::None());
+        PrepareFrameState(exit_cond, BailoutId::None());
         for_loop.BreakUnless(exit_cond);
         // TODO(dcarney): this runtime call should be a handful of
         //                simplified instructions that
         //                basically produce
         //                    value = array[index]
         environment()->Push(obj);
         environment()->Push(cache_array);
         environment()->Push(cache_type);
         environment()->Push(index);
         Node* pair =
@@ skipping 19 matching lines @@
           environment()->Push(jsgraph()->HeapConstant(function));
           // Receiver.
           environment()->Push(obj);
           // Args.
           environment()->Push(value);
           // result is either the string key or Smi(0) indicating the property
           // is gone.
           Node* res = ProcessArguments(
               javascript()->Call(3, NO_CALL_FUNCTION_FLAGS), 3);
           // TODO(jarin): provide real bailout id.
-          BuildLazyBailout(res, BailoutId::None());
+          PrepareFrameState(res, BailoutId::None());
           Node* property_missing = NewNode(javascript()->StrictEqual(), res,
                                            jsgraph()->ZeroConstant());
           {
             IfBuilder is_property_missing(this);
             is_property_missing.If(property_missing);
             is_property_missing.Then();
             // Inc counter and continue.
             Node* index_inc =
                 NewNode(javascript()->Add(), index, jsgraph()->OneConstant());
+            // TODO(jarin): provide real bailout id.
+            PrepareFrameState(index_inc, BailoutId::None());
             environment()->Poke(0, index_inc);
-            // TODO(jarin): provide real bailout id.
-            BuildLazyBailout(index_inc, BailoutId::None());
             for_loop.Continue();
             is_property_missing.Else();
             is_property_missing.End();
           }
           // Replace 'value' in environment.
           environment()->Push(res);
           test_should_filter.Else();
           test_should_filter.End();
         }
         value = environment()->Pop();
         // Bind value and do loop body.
         VisitForInAssignment(stmt->each(), value);
         VisitIterationBody(stmt, &for_loop, 5);
         // Inc counter and continue.
         Node* index_inc =
             NewNode(javascript()->Add(), index, jsgraph()->OneConstant());
+        // TODO(jarin): provide real bailout id.
+        PrepareFrameState(index_inc, BailoutId::None());
         environment()->Poke(0, index_inc);
-        // TODO(jarin): provide real bailout id.
-        BuildLazyBailout(index_inc, BailoutId::None());
         for_loop.EndBody();
         for_loop.EndLoop();
         environment()->Drop(5);
         // PrepareForBailoutForId(stmt->ExitId(), NO_REGISTERS);
       }
       have_no_properties.End();
     }
     is_null.End();
   }
   is_undefined.End();
@@ skipping 12 matching lines @@
 }
 
 
 void AstGraphBuilder::VisitTryFinallyStatement(TryFinallyStatement* stmt) {
   UNREACHABLE();
 }
 
 
 void AstGraphBuilder::VisitDebuggerStatement(DebuggerStatement* stmt) {
   // TODO(turbofan): Do we really need a separate reloc-info for this?
-  NewNode(javascript()->Runtime(Runtime::kDebugBreak, 0));
+  Node* node = NewNode(javascript()->Runtime(Runtime::kDebugBreak, 0));
+  PrepareFrameState(node, stmt->DebugBreakId());
 }
 
 
 void AstGraphBuilder::VisitFunctionLiteral(FunctionLiteral* expr) {
   Node* context = current_context();
 
   // Build a new shared function info if we cannot find one in the baseline
   // code. We also have a stack overflow if the recursive compilation did.
   Handle<SharedFunctionInfo> shared_info =
       SearchSharedFunctionInfo(info()->shared_info()->code(), expr);
@@ skipping 94 matching lines @@
       case ObjectLiteral::Property::COMPUTED: {
         // It is safe to use [[Put]] here because the boilerplate already
         // contains computed properties with an uninitialized value.
         if (key->value()->IsInternalizedString()) {
           if (property->emit_store()) {
             VisitForValue(property->value());
             Node* value = environment()->Pop();
             PrintableUnique<Name> name = MakeUnique(key->AsPropertyName());
             Node* store =
                 NewNode(javascript()->StoreNamed(name), literal, value);
-            BuildLazyBailout(store, key->id());
+            PrepareFrameState(store, key->id());
           } else {
             VisitForEffect(property->value());
           }
           break;
         }
         environment()->Push(literal);  // Duplicate receiver.
         VisitForValue(property->key());
         VisitForValue(property->value());
         Node* value = environment()->Pop();
         Node* key = environment()->Pop();
@@ skipping 71 matching lines @@
   // Create nodes to evaluate all the non-constant subexpressions and to store
   // them into the newly cloned array.
   for (int i = 0; i < expr->values()->length(); i++) {
     Expression* subexpr = expr->values()->at(i);
     if (CompileTimeValue::IsCompileTimeValue(subexpr)) continue;
 
     VisitForValue(subexpr);
     Node* value = environment()->Pop();
     Node* index = jsgraph()->Constant(i);
     Node* store = NewNode(javascript()->StoreProperty(), literal, index, value);
-    BuildLazyBailout(store, expr->GetIdForElement(i));
+    PrepareFrameState(store, expr->GetIdForElement(i));
   }
 
   environment()->Pop();  // Array literal index.
   ast_context()->ProduceValue(environment()->Pop());
 }
 
 
 void AstGraphBuilder::VisitForInAssignment(Expression* expr, Node* value) {
   DCHECK(expr->IsValidReferenceExpression());
 
@@ skipping 11 matching lines @@
     }
     case NAMED_PROPERTY: {
       environment()->Push(value);
       VisitForValue(property->obj());
       Node* object = environment()->Pop();
       value = environment()->Pop();
       PrintableUnique<Name> name =
           MakeUnique(property->key()->AsLiteral()->AsPropertyName());
       Node* store = NewNode(javascript()->StoreNamed(name), object, value);
       // TODO(jarin) Fill in the correct bailout id.
-      BuildLazyBailout(store, BailoutId::None());
+      PrepareFrameState(store, BailoutId::None());
       break;
     }
     case KEYED_PROPERTY: {
       environment()->Push(value);
       VisitForValue(property->obj());
       VisitForValue(property->key());
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
       value = environment()->Pop();
       Node* store = NewNode(javascript()->StoreProperty(), object, key, value);
       // TODO(jarin) Fill in the correct bailout id.
-      BuildLazyBailout(store, BailoutId::None());
+      PrepareFrameState(store, BailoutId::None());
       break;
     }
   }
 }
 
 
 void AstGraphBuilder::VisitAssignment(Assignment* expr) {
   DCHECK(expr->target()->IsValidReferenceExpression());
 
   // Left-hand side can only be a property, a global or a variable slot.
@@ skipping 23 matching lines @@
       case VARIABLE: {
         Variable* variable = expr->target()->AsVariableProxy()->var();
         old_value = BuildVariableLoad(variable, expr->target()->id());
         break;
       }
       case NAMED_PROPERTY: {
         Node* object = environment()->Top();
         PrintableUnique<Name> name =
             MakeUnique(property->key()->AsLiteral()->AsPropertyName());
         old_value = NewNode(javascript()->LoadNamed(name), object);
-        BuildLazyBailoutWithPushedNode(old_value, property->LoadId());
+        PrepareFrameState(old_value, property->LoadId(), PUSH_OUTPUT);
         break;
       }
       case KEYED_PROPERTY: {
         Node* key = environment()->Top();
         Node* object = environment()->Peek(1);
         old_value = NewNode(javascript()->LoadProperty(), object, key);
-        BuildLazyBailoutWithPushedNode(old_value, property->LoadId());
+        PrepareFrameState(old_value, property->LoadId(), PUSH_OUTPUT);
         break;
       }
     }
     environment()->Push(old_value);
     VisitForValue(expr->value());
     Node* right = environment()->Pop();
     Node* left = environment()->Pop();
     Node* value = BuildBinaryOp(left, right, expr->binary_op());
+    PrepareFrameState(value, expr->binary_operation()->id(), PUSH_OUTPUT);
     environment()->Push(value);
-    BuildLazyBailout(value, expr->binary_operation()->id());
   } else {
     VisitForValue(expr->value());
   }
 
   // Store the value.
   Node* value = environment()->Pop();
   switch (assign_type) {
     case VARIABLE: {
       Variable* variable = expr->target()->AsVariableProxy()->var();
       BuildVariableAssignment(variable, value, expr->op(),
                               expr->AssignmentId());
       break;
     }
     case NAMED_PROPERTY: {
       Node* object = environment()->Pop();
       PrintableUnique<Name> name =
           MakeUnique(property->key()->AsLiteral()->AsPropertyName());
       Node* store = NewNode(javascript()->StoreNamed(name), object, value);
-      BuildLazyBailout(store, expr->AssignmentId());
+      PrepareFrameState(store, expr->AssignmentId());
       break;
     }
     case KEYED_PROPERTY: {
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
       Node* store = NewNode(javascript()->StoreProperty(), object, key, value);
-      BuildLazyBailout(store, expr->AssignmentId());
+      PrepareFrameState(store, expr->AssignmentId());
       break;
     }
   }
 
   ast_context()->ProduceValue(value);
 }
 
 
 void AstGraphBuilder::VisitYield(Yield* expr) {
   VisitForValue(expr->generator_object());
@@ skipping 22 matching lines @@
     PrintableUnique<Name> name =
         MakeUnique(expr->key()->AsLiteral()->AsPropertyName());
     value = NewNode(javascript()->LoadNamed(name), object);
   } else {
     VisitForValue(expr->obj());
     VisitForValue(expr->key());
     Node* key = environment()->Pop();
     Node* object = environment()->Pop();
     value = NewNode(javascript()->LoadProperty(), object, key);
   }
-  ast_context()->ProduceValueWithLazyBailout(value);
+  PrepareFrameState(value, expr->id(), ast_context()->GetStateCombine());
+  ast_context()->ProduceValue(value);
 }
 
 
 void AstGraphBuilder::VisitCall(Call* expr) {
   Expression* callee = expr->expression();
   Call::CallType call_type = expr->GetCallType(isolate());
 
   // Prepare the callee and the receiver to the function call. This depends on
   // the semantics of the underlying call type.
   CallFunctionFlags flags = NO_CALL_FUNCTION_FLAGS;
@@ skipping 23 matching lines @@
       Node* object = environment()->Top();
       if (property->key()->IsPropertyName()) {
         PrintableUnique<Name> name =
             MakeUnique(property->key()->AsLiteral()->AsPropertyName());
         callee_value = NewNode(javascript()->LoadNamed(name), object);
       } else {
         VisitForValue(property->key());
         Node* key = environment()->Pop();
         callee_value = NewNode(javascript()->LoadProperty(), object, key);
       }
-      BuildLazyBailoutWithPushedNode(callee_value, property->LoadId());
+      PrepareFrameState(callee_value, property->LoadId(), PUSH_OUTPUT);
       receiver_value = environment()->Pop();
       // Note that a PROPERTY_CALL requires the receiver to be wrapped into an
       // object for sloppy callees. This could also be modeled explicitly here,
       // thereby obsoleting the need for a flag to the call operator.
       flags = CALL_AS_METHOD;
       break;
     }
     case Call::POSSIBLY_EVAL_CALL:
       possibly_eval = true;
     // Fall through.
@@ skipping 34 matching lines @@
     Node* new_receiver = NewNode(common()->Projection(1), pair);
 
     // Patch callee and receiver on the environment.
     environment()->Poke(arg_count + 1, new_callee);
     environment()->Poke(arg_count + 0, new_receiver);
   }
 
   // Create node to perform the function call.
   Operator* call = javascript()->Call(args->length() + 2, flags);
   Node* value = ProcessArguments(call, args->length() + 2);
-  ast_context()->ProduceValueWithLazyBailout(value);
+  PrepareFrameState(value, expr->id(), ast_context()->GetStateCombine());
+  ast_context()->ProduceValue(value);
 }
 
 
 void AstGraphBuilder::VisitCallNew(CallNew* expr) {
   VisitForValue(expr->expression());
 
   // Evaluate all arguments to the construct call.
   ZoneList<Expression*>* args = expr->arguments();
   VisitForValues(args);
 
   // Create node to perform the construct call.
   Operator* call = javascript()->CallNew(args->length() + 1);
   Node* value = ProcessArguments(call, args->length() + 1);
-  ast_context()->ProduceValueWithLazyBailout(value);
+  PrepareFrameState(value, expr->id(), ast_context()->GetStateCombine());
+  ast_context()->ProduceValue(value);
 }
 
 
 void AstGraphBuilder::VisitCallJSRuntime(CallRuntime* expr) {
   Handle<String> name = expr->name();
 
   // The callee and the receiver both have to be pushed onto the operand stack
   // before arguments are being evaluated.
   CallFunctionFlags flags = NO_CALL_FUNCTION_FLAGS;
   Node* receiver_value = BuildLoadBuiltinsObject();
   PrintableUnique<String> unique = MakeUnique(name);
   Node* callee_value = NewNode(javascript()->LoadNamed(unique), receiver_value);
-  environment()->Push(callee_value);
   // TODO(jarin): Find/create a bailout id to deoptimize to (crankshaft
   // refuses to optimize functions with jsruntime calls).
-  BuildLazyBailout(callee_value, BailoutId::None());
+  PrepareFrameState(callee_value, BailoutId::None(), PUSH_OUTPUT);
+  environment()->Push(callee_value);
   environment()->Push(receiver_value);
 
   // Evaluate all arguments to the JS runtime call.
   ZoneList<Expression*>* args = expr->arguments();
   VisitForValues(args);
 
   // Create node to perform the JS runtime call.
   Operator* call = javascript()->Call(args->length() + 2, flags);
   Node* value = ProcessArguments(call, args->length() + 2);
-  ast_context()->ProduceValueWithLazyBailout(value);
+  PrepareFrameState(value, expr->id(), ast_context()->GetStateCombine());
+  ast_context()->ProduceValue(value);
 }
 
 
 void AstGraphBuilder::VisitCallRuntime(CallRuntime* expr) {
   const Runtime::Function* function = expr->function();
 
   // Handle calls to runtime functions implemented in JavaScript separately as
   // the call follows JavaScript ABI and the callee is statically unknown.
   if (expr->is_jsruntime()) {
     DCHECK(function == NULL && expr->name()->length() > 0);
     return VisitCallJSRuntime(expr);
   }
 
   // Evaluate all arguments to the runtime call.
   ZoneList<Expression*>* args = expr->arguments();
   VisitForValues(args);
 
   // Create node to perform the runtime call.
   Runtime::FunctionId functionId = function->function_id;
   Operator* call = javascript()->Runtime(functionId, args->length());
   Node* value = ProcessArguments(call, args->length());
-  ast_context()->ProduceValueWithLazyBailout(value);
+  PrepareFrameState(value, expr->id(), ast_context()->GetStateCombine());
+  ast_context()->ProduceValue(value);
 }
 
 
 void AstGraphBuilder::VisitUnaryOperation(UnaryOperation* expr) {
   switch (expr->op()) {
     case Token::DELETE:
       return VisitDelete(expr);
     case Token::VOID:
       return VisitVoid(expr);
     case Token::TYPEOF:
@@ skipping 26 matching lines @@
       old_value = BuildVariableLoad(variable, expr->expression()->id());
       stack_depth = 0;
       break;
     }
     case NAMED_PROPERTY: {
       VisitForValue(property->obj());
       Node* object = environment()->Top();
       PrintableUnique<Name> name =
           MakeUnique(property->key()->AsLiteral()->AsPropertyName());
       old_value = NewNode(javascript()->LoadNamed(name), object);
-      BuildLazyBailoutWithPushedNode(old_value, property->LoadId());
+      PrepareFrameState(old_value, property->LoadId(), PUSH_OUTPUT);
       stack_depth = 1;
       break;
     }
     case KEYED_PROPERTY: {
       VisitForValue(property->obj());
       VisitForValue(property->key());
       Node* key = environment()->Top();
       Node* object = environment()->Peek(1);
       old_value = NewNode(javascript()->LoadProperty(), object, key);
-      BuildLazyBailoutWithPushedNode(old_value, property->LoadId());
+      PrepareFrameState(old_value, property->LoadId(), PUSH_OUTPUT);
       stack_depth = 2;
       break;
     }
   }
 
   // Convert old value into a number.
   old_value = NewNode(javascript()->ToNumber(), old_value);
 
   // Save result for postfix expressions at correct stack depth.
   if (is_postfix) environment()->Poke(stack_depth, old_value);
 
   // Create node to perform +1/-1 operation.
   Node* value =
       BuildBinaryOp(old_value, jsgraph()->OneConstant(), expr->binary_op());
   // TODO(jarin) Insert proper bailout id here (will need to change
   // full code generator).
-  BuildLazyBailout(value, BailoutId::None());
+  PrepareFrameState(value, BailoutId::None());
 
   // Store the value.
   switch (assign_type) {
     case VARIABLE: {
       Variable* variable = expr->expression()->AsVariableProxy()->var();
       BuildVariableAssignment(variable, value, expr->op(),
                               expr->AssignmentId());
       break;
     }
     case NAMED_PROPERTY: {
       Node* object = environment()->Pop();
       PrintableUnique<Name> name =
           MakeUnique(property->key()->AsLiteral()->AsPropertyName());
       Node* store = NewNode(javascript()->StoreNamed(name), object, value);
-      BuildLazyBailout(store, expr->AssignmentId());
+      PrepareFrameState(store, expr->AssignmentId());
       break;
     }
     case KEYED_PROPERTY: {
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
       Node* store = NewNode(javascript()->StoreProperty(), object, key, value);
-      BuildLazyBailout(store, expr->AssignmentId());
+      PrepareFrameState(store, expr->AssignmentId());
       break;
     }
   }
 
   // Restore old value for postfix expressions.
   if (is_postfix) value = environment()->Pop();
 
   ast_context()->ProduceValue(value);
 }
 
 
 void AstGraphBuilder::VisitBinaryOperation(BinaryOperation* expr) {
   switch (expr->op()) {
     case Token::COMMA:
       return VisitComma(expr);
     case Token::OR:
     case Token::AND:
       return VisitLogicalExpression(expr);
     default: {
       VisitForValue(expr->left());
       VisitForValue(expr->right());
       Node* right = environment()->Pop();
       Node* left = environment()->Pop();
       Node* value = BuildBinaryOp(left, right, expr->op());
-      ast_context()->ProduceValueWithLazyBailout(value);
+      PrepareFrameState(value, expr->id(), ast_context()->GetStateCombine());
+      ast_context()->ProduceValue(value);
     }
   }
 }
 
 
 void AstGraphBuilder::VisitCompareOperation(CompareOperation* expr) {
   Operator* op;
   switch (expr->op()) {
     case Token::EQ:
       op = javascript()->Equal();
@@ skipping 27 matching lines @@
       break;
     default:
       op = NULL;
       UNREACHABLE();
   }
   VisitForValue(expr->left());
   VisitForValue(expr->right());
   Node* right = environment()->Pop();
   Node* left = environment()->Pop();
   Node* value = NewNode(op, left, right);
+  PrepareFrameState(value, expr->id(), ast_context()->GetStateCombine());
   ast_context()->ProduceValue(value);
-
-  BuildLazyBailout(value, expr->id());
 }
 
 
 void AstGraphBuilder::VisitThisFunction(ThisFunction* expr) {
   Node* value = GetFunctionClosure();
   ast_context()->ProduceValue(value);
 }
 
 
 void AstGraphBuilder::VisitSuperReference(SuperReference* expr) {
@@ skipping 214 matching lines @@
                                          ContextualMode contextual_mode) {
   Node* the_hole = jsgraph()->TheHoleConstant();
   VariableMode mode = variable->mode();
   switch (variable->location()) {
     case Variable::UNALLOCATED: {
       // Global var, const, or let variable.
       Node* global = BuildLoadGlobalObject();
       PrintableUnique<Name> name = MakeUnique(variable->name());
       Operator* op = javascript()->LoadNamed(name, contextual_mode);
       Node* node = NewNode(op, global);
-      BuildLazyBailoutWithPushedNode(node, bailout_id);
+      PrepareFrameState(node, bailout_id, PUSH_OUTPUT);
       return node;
     }
     case Variable::PARAMETER:
     case Variable::LOCAL: {
       // Local var, const, or let variable.
       Node* value = environment()->Lookup(variable);
       if (mode == CONST_LEGACY) {
         // Perform check for uninitialized legacy const variables.
         if (value->op() == the_hole->op()) {
           value = jsgraph()->UndefinedConstant();
@@ skipping 80 matching lines @@
                                                BailoutId bailout_id) {
   Node* the_hole = jsgraph()->TheHoleConstant();
   VariableMode mode = variable->mode();
   switch (variable->location()) {
     case Variable::UNALLOCATED: {
       // Global var, const, or let variable.
       Node* global = BuildLoadGlobalObject();
       PrintableUnique<Name> name = MakeUnique(variable->name());
       Operator* op = javascript()->StoreNamed(name);
       Node* store = NewNode(op, global, value);
-      BuildLazyBailout(store, bailout_id);
+      PrepareFrameState(store, bailout_id);
       return store;
     }
     case Variable::PARAMETER:
     case Variable::LOCAL:
       // Local var, const, or let variable.
       if (mode == CONST_LEGACY && op == Token::INIT_CONST_LEGACY) {
         // Perform an initialization check for legacy const variables.
         Node* current = environment()->Lookup(variable);
         if (current->op() != the_hole->op()) {
           value = BuildHoleCheckSilent(current, value, current);
@@ skipping 131 matching lines @@
       js_op = javascript()->Modulus();
       break;
     default:
       UNREACHABLE();
       js_op = NULL;
   }
   return NewNode(js_op, left, right);
 }
 
 
-void AstGraphBuilder::BuildLazyBailout(Node* node, BailoutId ast_id) {
+void AstGraphBuilder::PrepareFrameState(Node* node, BailoutId ast_id,
+                                        OutputFrameStateCombine combine) {
+  if (OperatorProperties::HasFrameStateInput(node->op())) {
+    int frame_state_index = NodeProperties::GetFrameStateIndex(node);
+
+    DCHECK(node->InputAt(frame_state_index)->op()->opcode() == IrOpcode::kDead);
+
+    Node* frame_state_node = environment()->Checkpoint(ast_id);
+    node->ReplaceInput(frame_state_index, frame_state_node);
+  }
+
   if (OperatorProperties::CanLazilyDeoptimize(node->op())) {
     // The deopting node should have an outgoing control dependency.
     DCHECK(environment()->GetControlDependency() == node);
 
     StructuredGraphBuilder::Environment* continuation_env = environment();
     // Create environment for the deoptimization block, and build the block.
     StructuredGraphBuilder::Environment* deopt_env =
         CopyEnvironment(continuation_env);
     set_environment(deopt_env);
 
+    if (combine == PUSH_OUTPUT) {
+      environment()->Push(node);
+    }
+
     NewNode(common()->LazyDeoptimization());
 
     // TODO(jarin) If ast_id.IsNone(), perhaps we should generate an empty
     // deopt block and make sure there is no patch entry for this (so
     // that the deoptimizer dies when trying to deoptimize here).
-
     Node* state_node = environment()->Checkpoint(ast_id);
-
     Node* deoptimize_node = NewNode(common()->Deoptimize(), state_node);
-
     UpdateControlDependencyToLeaveFunction(deoptimize_node);
 
     // Continue with the original environment.
     set_environment(continuation_env);
-
     NewNode(common()->Continuation());
   }
 }
 
-
-void AstGraphBuilder::BuildLazyBailoutWithPushedNode(Node* node,
-                                                     BailoutId ast_id) {
-  environment()->Push(node);
-  BuildLazyBailout(node, ast_id);
-  environment()->Pop();
-}
 }
 }
 }  // namespace v8::internal::compiler