[turbofan] No longer ignore FrameState input to Call

R=mstarzinger@chromium.org

BUG=chromium:683566

Review-Url: https://codereview.chromium.org/2653953010
Cr-Commit-Position: refs/heads/master@{#42737}

src/compiler/escape-analysis.cc

@@ -12,6 +12,7 @@
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph-reducer.h"
 #include "src/compiler/js-operator.h"
+#include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/node.h"
@@ -1068,6 +1069,19 @@ bool EscapeStatusAnalysis::IsEffectBranchPoint(Node* node) {
   return false;
 }
 
+namespace {
+
+bool HasFrameStateInput(const Operator* op) {
+  if (op->opcode() == IrOpcode::kCall || op->opcode() == IrOpcode::kTailCall) {
+    const CallDescriptor* d = CallDescriptorOf(op);
+    return d->NeedsFrameState();
+  } else {
+    return OperatorProperties::HasFrameStateInput(op);
+  }
+}
+
+}  // namespace
+
 bool EscapeAnalysis::Process(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kAllocate:
@@ -1104,7 +1118,7 @@ bool EscapeAnalysis::Process(Node* node) {
       ProcessAllocationUsers(node);
       break;
   }
-  if (OperatorProperties::HasFrameStateInput(node->op())) {
+  if (HasFrameStateInput(node->op())) {
     virtual_states_[node->id()]->SetCopyRequired();
   }
   return true;

test/mjsunit/compiler/escape-analysis-11.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo --turbo-escape
+
+function g() {
+  ({}).a += '';
+  if (false) eval();
+}
+
+function f() {
+  g();
+}
+
+f();
+f();
+% OptimizeFunctionOnNextCall(f);
+f();