[turbofan] Carefully update frame states during inlining.

During inlining we should pay attention to only rewire the outer frame
states of the inlinee, but leave any inner frame states of the inlinee
untouched.  Otherwise we might run into trouble once we start caching
graphs, or do getter/setter inlining.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1134973006

Cr-Commit-Position: refs/heads/master@{#28466}

src/compiler/js-inlining.cc

@@ -351,10 +351,15 @@ Reduction JSInliner::Reduce(Node* node) {
     outer_frame_state = CreateArgumentsAdaptorFrameState(&call, info.zone());
   }
 
-  for (Node* node : visitor.copies()) {
-    if (node && node->opcode() == IrOpcode::kFrameState) {
+  // Fix up all outer frame states from the inlinee.
+  for (Node* const node : visitor.copies()) {
+    if (node->opcode() == IrOpcode::kFrameState) {
       DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
-      NodeProperties::ReplaceFrameStateInput(node, 0, outer_frame_state);
+      // Don't touch this frame state, if it already has an "outer frame state".
+      if (NodeProperties::GetFrameStateInput(node, 0)->opcode() !=
+          IrOpcode::kFrameState) {
+        NodeProperties::ReplaceFrameStateInput(node, 0, outer_frame_state);
+      }
     }
   }