[turbofan] Add an extra frame state for deoptimization before binary op.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 60440d273511ab198ddf7dd3fc18b7105f655ec5..e4bad0b6691a144cac2b12932717c049b7d999ee 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -646,8 +646,9 @@ Reduction JSTypedLowering::ReduceJSToNumber(Node* node) {
       NodeProperties::ReplaceContextInput(node, jsgraph()->NoContextConstant());
       NodeProperties::ReplaceControlInput(node, graph()->start());
       NodeProperties::ReplaceEffectInput(node, graph()->start());
-      if (OperatorProperties::HasFrameStateInput(node->op())) {
-        NodeProperties::ReplaceFrameStateInput(node,
+      if (FLAG_turbo_deoptimization) {
+        DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
+        NodeProperties::ReplaceFrameStateInput(node, 0,
                                                jsgraph()->EmptyFrameState());
       }
       return Changed(node);
@@ -769,8 +770,10 @@ Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) {
         if (number_reduction.Changed()) {
           value = number_reduction.replacement();
         } else {
-          if (OperatorProperties::HasFrameStateInput(
-                  javascript()->ToNumber())) {
+          DCHECK(FLAG_turbo_deoptimization ==
+                 (OperatorProperties::GetFrameStateInputCount(
+                      javascript()->ToNumber()) == 1));
+          if (FLAG_turbo_deoptimization) {
             value = effect =
                 graph()->NewNode(javascript()->ToNumber(), value, context,
                                  jsgraph()->EmptyFrameState(), effect, control);