[turbofan] Use ReturnId for lazy bailout of JSCallFunction.

We need to use the ReturnId for calls, otherwise lazy bailout will not
work correctly in case of inlining.

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1407953004

Cr-Commit-Position: refs/heads/master@{#31401}

src/compiler/ast-graph-builder.cc

@@ -2466,7 +2466,9 @@ void AstGraphBuilder::VisitCall(Call* expr) {
   const Operator* call = javascript()->CallFunction(args->length() + 2, flags,
                                                     language_mode(), feedback);
   Node* value = ProcessArguments(call, args->length() + 2);
-  PrepareFrameState(value, expr->id(), ast_context()->GetStateCombine());
+  environment()->Push(callee_value);
+  PrepareFrameState(value, expr->ReturnId(), OutputFrameStateCombine::Push());
+  environment()->Drop(1);
   ast_context()->ProduceValue(value);
 }