[deoptimizer] Potentially deopt into debug bytecode.

This makes sure the deoptimizer picks bytecode prepared for debugging
when materializing an interpreted frame if one is available. This is
normally done by the interpreter entry trampoline and hence needs to be
replicated by the deoptimizer.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2271443003
Cr-Commit-Position: refs/heads/master@{#38815}

src/deoptimizer.cc

@@ -1234,7 +1234,9 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
 
   // Set the bytecode array pointer.
   output_offset -= kPointerSize;
-  Object* bytecode_array = shared->bytecode_array();
+  Object* bytecode_array = shared->HasDebugInfo()
+                               ? shared->GetDebugInfo()->DebugBytecodeArray()
+                               : shared->bytecode_array();
   WriteValueToOutput(bytecode_array, 0, frame_index, output_offset,
                      "bytecode array ");
 

test/mjsunit/mjsunit.status

@@ -57,7 +57,7 @@
 
   # Issue 3660: Replacing activated TurboFan frames by unoptimized code does
   # not work, but we expect it to not crash.
-  'debug-step-turbofan': [FAIL],
+  'debug-step-turbofan': [PASS, FAIL],
 
   ##############################################################################
   # Too slow in debug mode with --stress-opt mode.