[turbofan] Add an extra frame state for deoptimization before binary op.

src/compiler/js-intrinsic-lowering.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-intrinsic-lowering.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties.h"
 
@@ skipping 27 matching lines @@
     default:
       break;
   }
   return NoChange();
 }
 
 
 Reduction JSIntrinsicLowering::ReduceDeoptimizeNow(Node* node) {
   if (!FLAG_turbo_deoptimization) return NoChange();
 
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node, 0);
   DCHECK_EQ(frame_state->opcode(), IrOpcode::kFrameState);
 
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // We are making the continuation after the call dead. To
   // model this, we generate if (true) statement with deopt
   // in the true branch and continuation in the false branch.
   Node* branch =
       graph()->NewNode(common()->Branch(), jsgraph()->TrueConstant(), control);
@@ skipping 166 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSIntrinsicLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8