[turbofan] Support lazy deopt for truncating store to a typed array.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
@@ skipping 785 matching lines @@
       // Convert to a number first.
       if (!value_type->Is(Type::Number())) {
         Reduction number_reduction = ReduceJSToNumberInput(value);
         if (number_reduction.Changed()) {
           value = number_reduction.replacement();
         } else {
           DCHECK(FLAG_turbo_deoptimization ==
                  (OperatorProperties::GetFrameStateInputCount(
                       javascript()->ToNumber()) == 1));
           if (FLAG_turbo_deoptimization) {
+            Node* frame_state_for_to_number =
+                NodeProperties::GetFrameStateInput(node, 1);
             value = effect =
                 graph()->NewNode(javascript()->ToNumber(), value, context,
-                                 jsgraph()->EmptyFrameState(), effect, control);
+                                 frame_state_for_to_number, effect, control);
           } else {
             value = effect = graph()->NewNode(javascript()->ToNumber(), value,
                                               context, effect, control);
           }
         }
       }
       // For integer-typed arrays, convert to the integer type.
       if (TypeOf(access.machine_type()) == kTypeInt32 &&
           !value_type->Is(Type::Signed32())) {
         value = graph()->NewNode(simplified()->NumberToInt32(), value);
@@ skipping 231 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8