[turbofan] Fix bunch of tests failing with --turbo-deoptimization.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/786333004

Cr-Commit-Position: refs/heads/master@{#26115}

src/compiler/linkage.cc

@@ -152,13 +152,16 @@ bool Linkage::NeedsFrameState(Runtime::FunctionId function) {
     case Runtime::kDebugGetLoadedScripts:
     case Runtime::kDebugGetPropertyDetails:
     case Runtime::kDebugPromiseEvent:
+    case Runtime::kDefaultConstructorSuperCall:
     case Runtime::kDefineAccessorPropertyUnchecked:
     case Runtime::kDefineDataPropertyUnchecked:
     case Runtime::kDeleteProperty:
+    case Runtime::kDeliverObservationChangeRecords:
     case Runtime::kDeoptimizeFunction:
     case Runtime::kFunctionBindArguments:
     case Runtime::kGetDefaultReceiver:
     case Runtime::kGetFrameCount:
+    case Runtime::kGetFrameDetails:
     case Runtime::kGetOwnProperty:
     case Runtime::kGetOwnPropertyNames:
     case Runtime::kGetPropertyNamesFast:

src/compiler/simplified-lowering.cc

@@ -1014,8 +1014,9 @@ class RepresentationSelector {
       case IrOpcode::kLoadStackPointer:
         return VisitLeaf(node, kMachPtr);
       case IrOpcode::kStateValues:
+        // State values declare tagged use so that we do not conflate values.
         for (int i = 0; i < node->InputCount(); i++) {
-          ProcessInput(node, i, kTypeAny);
+          Enqueue(node->InputAt(i), kMachAnyTagged);
         }
         SetOutput(node, kMachAnyTagged);
         break;

src/runtime/runtime-debug.cc

@@ -2202,9 +2202,17 @@ RUNTIME_FUNCTION(Runtime_DebugEvaluate) {
   StackFrame::Id id = UnwrapFrameId(wrapped_id);
   JavaScriptFrameIterator it(isolate, id);
   JavaScriptFrame* frame = it.frame();
+  Handle<JSFunction> function;
+  Handle<SharedFunctionInfo> outer_info;
+  Handle<JSObject> materialized;
+  Handle<Context> eval_context;
+  {
+    // We need a short scope for re-entrancy as we cannot have two frame
+    // inspectors at the same time (because they are using a global variable).
     FrameInspector frame_inspector(frame, inlined_jsframe_index, isolate);
-  Handle<JSFunction> function(JSFunction::cast(frame_inspector.GetFunction()));
-  Handle<SharedFunctionInfo> outer_info(function->shared());
+    function =
+        Handle<JSFunction>(JSFunction::cast(frame_inspector.GetFunction()));
+    outer_info = Handle<SharedFunctionInfo>(function->shared());
 
     // Traverse the saved contexts chain to find the active context for the
     // selected frame.
@@ -2214,12 +2222,12 @@ RUNTIME_FUNCTION(Runtime_DebugEvaluate) {
     isolate->set_context(*(save->context()));
 
     // Materialize stack locals and the arguments object.
-  Handle<JSObject> materialized = NewJSObjectWithNullProto(isolate);
+    materialized = NewJSObjectWithNullProto(isolate);
 
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, materialized,
-      MaterializeStackLocalsWithFrameInspector(isolate, materialized, function,
-                                               &frame_inspector));
+        MaterializeStackLocalsWithFrameInspector(isolate, materialized,
+                                                 function, &frame_inspector));
 
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, materialized,
@@ -2231,7 +2239,8 @@ RUNTIME_FUNCTION(Runtime_DebugEvaluate) {
     // context. In order to have the same lookup chain when debug-evaluating,
     // we materialize the stack and insert it into the context chain as a
     // with-context before the function context.
-  // [inner context] -> [with context] -> [function context] -> [outer context]
+    // [inner context] -> [with context] -> [function context] -> [outer
+    // context]
     // Ordering the with-context before the function context forces a dynamic
     // lookup instead of a static lookup that could fail as the scope info is
     // outdated and may expect variables to still be stack-allocated.
@@ -2240,8 +2249,9 @@ RUNTIME_FUNCTION(Runtime_DebugEvaluate) {
     // This could cause lookup failures if debug-evaluate creates a closure that
     // uses this temporary context chain.
 
-  Handle<Context> eval_context(Context::cast(frame_inspector.GetContext()));
+    eval_context = Handle<Context>(Context::cast(frame_inspector.GetContext()));
     DCHECK(!eval_context.is_null());
+  }
   Handle<Context> function_context = eval_context;
   Handle<Context> outer_context(function->context(), isolate);
   Handle<Context> inner_context;

test/mjsunit/mjsunit.status

@@ -83,12 +83,8 @@
   'debug-step-turbofan': [PASS, FAIL],
 
   # TODO(jarin): Some tests don't like --turbo-deoptimzation very much.
-  'asm/embenchen/lua_binarytrees': [SKIP],
   'es6/symbols': [PASS, NO_VARIANTS],
-  'es7/object-observe-debug-event': [PASS, NO_VARIANTS],
-  'harmony/classes': [PASS, NO_VARIANTS],
   'regress/regress-354433': [PASS, NO_VARIANTS],  # only on ARM simulator.
-  'regress/regress-crbug-259300': [PASS, NO_VARIANTS],
 
   # TODO(arv): TurboFan does not yet add [[HomeObject]] as needed.
   'harmony/object-literals-super': [PASS, NO_VARIANTS],