[turbofan] Allow deoptimization for JSToNumber operator.

src/compiler/change-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/change-lowering.h"
 
 #include "src/code-factory.h"
 #include "src/compiler/diamond.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
@@ skipping 209 matching lines @@
     //     else LoadHeapNumberValue(y)
     Node* const object = NodeProperties::GetValueInput(value, 0);
     Node* const context = NodeProperties::GetContextInput(value);
     Node* const effect = NodeProperties::GetEffectInput(value);
     Node* const control = NodeProperties::GetControlInput(value);
 
     Diamond d1(graph(), common(), TestNotSmi(object), BranchHint::kFalse);
     d1.Chain(control);
 
     Node* number =
-        graph()->NewNode(value->op(), object, context, effect, d1.if_true);
+        OperatorProperties::HasFrameStateInput(value->op())
+            ? graph()->NewNode(value->op(), object, context,
+                               NodeProperties::GetFrameStateInput(value),
+                               effect, d1.if_true)
+            : graph()->NewNode(value->op(), object, context, effect,
+                               d1.if_true);
     Diamond d2(graph(), common(), TestNotSmi(number));
     d2.Nest(d1, true);
     Node* phi2 = d2.Phi(kMachFloat64, LoadHeapNumberValue(number, d2.if_true),
                         ChangeSmiToFloat64(number));
 
     Node* phi1 = d1.Phi(kMachFloat64, phi2, ChangeSmiToFloat64(object));
     Node* ephi1 = d1.EffectPhi(number, effect);
 
     for (Edge edge : value->use_edges()) {
       if (NodeProperties::IsEffectEdge(edge)) {
@@ skipping 33 matching lines @@
 }
 
 
 MachineOperatorBuilder* ChangeLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8