[turbofan] Remember types for deoptimization during simplified lowering.

test/mjsunit/compiler/regress-468727.js

Index: test/mjsunit/compiler/regress-468727.js
diff --git a/test/mjsunit/compiler/regress-416359.js b/test/mjsunit/compiler/regress-468727.js
similarity index 52%
copy from test/mjsunit/compiler/regress-416359.js
copy to test/mjsunit/compiler/regress-468727.js
index 18cdc5e72800ab16c49ea2f2091b88ba1c873248..a69efe5a56552831afe052aa24d1225a87306ab5 100644
--- a/test/mjsunit/compiler/regress-416359.js
+++ b/test/mjsunit/compiler/regress-468727.js
@@ -2,9 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-"use strict"
+// Flags: --noanalyze-environment-liveness
+
 function f() {
-  for (x in {a:0});
+  var __v_7 = -126 - __v_3;
+  var __v_17 = ((__v_15 & __v_14) != 4) | 16;
+  if (__v_17) {
+    var __v_11 = 1 << __v_7;
+  }
+  __v_12 >>= __v_3;
 }
 
 assertThrows(f);