[turbofan] Add an extra frame state for deoptimization before binary op.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 60440d273511ab198ddf7dd3fc18b7105f655ec5..8e7d6d6753e9059396b16db2b7a1c78dce22a249 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -646,8 +646,9 @@ Reduction JSTypedLowering::ReduceJSToNumber(Node* node) {
       NodeProperties::ReplaceContextInput(node, jsgraph()->NoContextConstant());
       NodeProperties::ReplaceControlInput(node, graph()->start());
       NodeProperties::ReplaceEffectInput(node, graph()->start());
-      if (OperatorProperties::HasFrameStateInput(node->op())) {
-        NodeProperties::ReplaceFrameStateInput(node,
+      if (FLAG_turbo_deoptimization) {
+        DCHECK(OperatorProperties::GetFrameStateInputCount(node->op()) == 1);

[Benedikt Meurer, 2015/03/09 05:32:34]

DCHECK_EQ?

[Jarin, 2015/03/09 07:47:11]

Done.

+        NodeProperties::ReplaceFrameStateInput(node, 0,
                                                jsgraph()->EmptyFrameState());
       }
       return Changed(node);
@@ -769,8 +770,10 @@ Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) {
         if (number_reduction.Changed()) {
           value = number_reduction.replacement();
         } else {
-          if (OperatorProperties::HasFrameStateInput(
-                  javascript()->ToNumber())) {
+          DCHECK(FLAG_turbo_deoptimization ==

[Benedikt Meurer, 2015/03/09 05:32:34]

DCHECK_EQ?

+                 (OperatorProperties::GetFrameStateInputCount(
+                      javascript()->ToNumber()) == 1));
+          if (FLAG_turbo_deoptimization) {
             value = effect =
                 graph()->NewNode(javascript()->ToNumber(), value, context,
                                  jsgraph()->EmptyFrameState(), effect, control);