[turbofan] Add an extra frame state for deoptimization before binary op.

src/compiler/change-lowering.cc

Index: src/compiler/change-lowering.cc
diff --git a/src/compiler/change-lowering.cc b/src/compiler/change-lowering.cc
index 0d9aa508ad671196057770dc7e38844cf4487dc6..fffd8bf896fa7e41bfe7cc29307967168cecf9bf 100644
--- a/src/compiler/change-lowering.cc
+++ b/src/compiler/change-lowering.cc
@@ -229,10 +229,12 @@ Reduction ChangeLowering::ChangeTaggedToFloat64(Node* value, Node* control) {
     Diamond d1(graph(), common(), TestNotSmi(object), BranchHint::kFalse);
     d1.Chain(control);
 
+    DCHECK_EQ(FLAG_turbo_deoptimization,
+              OperatorProperties::GetFrameStateInputCount(value->op()) == 1);
     Node* number =
-        OperatorProperties::HasFrameStateInput(value->op())
+        FLAG_turbo_deoptimization
             ? graph()->NewNode(value->op(), object, context,
-                               NodeProperties::GetFrameStateInput(value),
+                               NodeProperties::GetFrameStateInput(value, 0),
                                effect, d1.if_true)
             : graph()->NewNode(value->op(), object, context, effect,
                                d1.if_true);